4 ms·
Wouldn't this allow modifying a cached version of /sbin/su to nop the password check? This seems really easy to exploit for privilege escalation.
by MayeulC 5y ago
Wouldn't this allow modifying a cached version of /sbin/su to nop the password check? This seems really easy to exploit for privilege escalation.
- max_k 5y agoYes. But you can also inject code into libc.so.6, and all running processes will have it.
- staticassertion 5y agoOr /etc/passwd
- freemint 5y agoYes it would. That is implied because writing arbitrary files means you can also edit the permission systems