There is a new linux vulnerability that allows every unprivileged user to become root super easily

https://copy.fail/

192 points · 14 comments · view on lemmy.world

14 Comments

bjoern_tantau@swg-empire.de · 60 pts · 107d (5 replies)

Ugh, another new "sudo" clone.

ryannathans@aussie.zone · 29 pts · 107d (3 replies)

Much smaller than sudo

RiceMunk@sopuli.xyz · 34 pts · 107d (2 replies)

surprise new linux feature: Much more space-efficient sudo command

LedgeDrop@lemmy.zip · 11 pts · 107d (1 reply)

... 'cause I always keep forgetting my password.

I am curious to see if/how this'll open up some android devices.

Codilingus@piefed.social · 4 pts · 106d

My brain was too moosh for the technical reading, but I saw GrapheneOS say they're immune to it. So probably not good for regular Android, lol.

corsicanguppy@lemmy.ca · 5 pts · 106d

They rolled their own encryption sudo.

Dadifer@lemmy.world · 31 pts · 107d

In the writeup, they say there's multiple other vulnerabilities on this attack surface, but they're still working on responsible disclosure.

Corngood@lemmy.ml · 26 pts · 106d (2 replies)

It feels weird that it has it's own domain name and slogan. I get that there's a promotional aspect to it, but it seems a bit much.

Rossphorus@lemmy.world · 9 pts · 106d

This is not uncommon for high-profile CVEs. For example, brokenwire.fail, heartbleed.com, spectreattack.com, etc..

bookmeat@fedinsfw.app · 4 pts · 106d

They had a month to set it up.

MasterNerd@lemmy.zip · 15 pts · 106d (1 reply)

Hmm seems like that report is AI generated

thesmokingman@programming.dev · 8 pts · 106d

It is. The vuln itself was found with guidance of an AI tool. Doesn’t make the vuln any less bad. Does make Xint look really shitty for constantly shilling with boilerplate AI instead of a good human analysis (or at least something above boilerplate).

corsicanguppy@lemmy.ca · 3 pts · 106d (1 reply)

Only if you enable the mode for rootless containers. If you run more safe, this thing is apparently impotent.

No containers here, no cry.

timwa@lemmy.snowgoons.ro · 6 pts · 106d

Where are you getting that from? That's not the case at all.