5 ms·
This if f*cking scary. Such a simple code, so dangerous and it works. You can trivially add an extra root user via /etc/{passwd|shadow}. There are tons of optio
by itvision 5y ago
This if f*cking scary. Such a simple code, so dangerous and it works. You can trivially add an extra root user via /etc/{passwd|shadow}. There are tons of options how to p0wn a system.
Please update your devices ASAP!
- pabs3 5y agoThose unsupported devices probably don't run Linux 5.8 or later, they are likely on older versions. It would be really useful to have this vuln on them though, it would help with getting root so you can get control of your own device and install your own choice of OS.
- itvision 5y agoYou're right, I though kernel 5.8 is a lot older than it actually is. I've edited my post. Sorry!
- lazide 5y agoEh, it’s a limited subset of kernel versions (ones unlikely to be used in those devices), and requires local execution privileges and access to the file system. Linux in general has had numerous security issues (as has every other OS), often requiring far less access. Does it need patching? Of course. It’s not a privilege escalation remote code execution issue though, and even if it was, it would be on a tiny fraction of running devices right now.
- itvision 5y ago> and even if it was, it would be on a tiny fraction of running devices right now. That's correct and I misjudged the situation. Sorry!
- deleted 5y ago[deleted]