4 ms·
Easy-to-exploit Linux bug gives attackers root
- mdp2021 5y agoOriginal title: "A bug lurking for 12 years gives attackers root on every major Linux distro // It's likely only a matter of time until PwnKit is exploited in the wild" > a 12-year-old vulnerability in a system tool called Polkit gives attackers unfettered root privileges Original publication of finding at https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034 https://blog.qualys.com/vulnerabilities-threat-research/2022... Immediate patch (though distributions are already providing security updates): remove the SUID-bit from `pkexec` # chmod 0755 /usr/bin/pkexec ... The article from blog.qualys.com (signed Bharat Jogi) is very, very well written, and instructive. It would be nice to have a good collection of these sources.