Devastating 'Dirty Frag' exploit leaks out, gives immediate root access on most Linux machines since 2017, no patches available, no warning given — Copy Fail-like vulnerability had its embargo broken : pcmasterrace

[-] iopq@lemmy.world 57 points 2 weeks ago* (last edited 2 weeks ago)

That article doesn't tell me much. Any writeup with the affected code?

Edit: found it

https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md

[-] carrylex@lemmy.world 49 points 2 weeks ago* (last edited 2 weeks ago)

Non Tom's slopware original:

https://github.com/V4bel/dirtyfrag

Also nice lies and panic spreading by them:

that's currently setting the Linux server world on fire

The vulnerability requires local user access to the affected system which is already a gigantic security hole if that's the case on a server...

Tom's Slopware delenda est

[-] degenerate_neutron_matter@fedia.io 15 points 2 weeks ago

It's a big problem for multi-user servers where some users aren't supposed to have root access. For example, my university has several student-accessible servers, and they all seem to be currently vulnerable to the exploit. A malicious student could cause quite a lot of damage.

[-] Saprophyte@lemmy.world 9 points 2 weeks ago

No patches available!

Literally a mitigation section on the page.

[-] Azzu@lemmy.dbzer0.com 35 points 2 weeks ago

"No patches available" might've been true at time of writing (and might still be true for old kernels, idk), but kernel 7.0.4, released yesterday, is already fixed.

[-] Nighed@feddit.uk 13 points 2 weeks ago

What is the exploit case? It says it's IPsec stuff?

Is it therefore remotely exploitable, or does it need a local user?

Are routers at risk?

[-] grainfed@quokk.au 27 points 2 weeks ago

"any local user can instantly get root (administrator) access on an affected box, just by running a small program" quote from the short article. So it seems home computers are safe.

[-] Nighed@feddit.uk 1 points 2 weeks ago

I thought that was refering to copyfail?

[-] sanitation@lemmy.radio 15 points 2 weeks ago

It's gotta be local.

[-] bookmeat@fedinsfw.app 11 points 2 weeks ago

It bothers me that the test for this vulnerability is a link to some random repo online with arbitrary code and no one is batting an eye.

[-] clif@lemmy.world 3 points 2 weeks ago* (last edited 2 weeks ago)

At least it presents code instead of "here's sooperhax.exe, just run it"

Also @iopq@lemmy.world linked the explanation in the repo : https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md

Admittedly I just gave it a quick scan for now though.

[-] M0oP0o@mander.xyz 8 points 2 weeks ago

NICE! Linux has made it everyone!

[-] cholesterol@lemmy.world 6 points 2 weeks ago

Also local, right?

[-] yetAnotherUser@discuss.tchncs.de 2 points 2 weeks ago

People don't realize how easy it is to get local access.

There's a very good reason you should not run your browser as root.

[-] Treczoks@lemmy.world 2 points 2 weeks ago

This and the others will probably be fixed as fast as usual, and the NSA, the CIA, and their Chinese, Russian, and whatever counterparts will have one less exploit in their arsenals.

[+] bulwark@lemmy.world -26 points 2 weeks ago* (last edited 2 weeks ago)

Why does Microsoft keep funding all these Linux exploits?

[-] pastermil@sh.itjust.works 28 points 2 weeks ago

Where does it say in the article?

Even if it's true, wouldn't it be a good thing, since it probably wouldn't be found otherwise?

[+] bulwark@lemmy.world -26 points 2 weeks ago

Short answer, nothing. Long answer, Mcafee, Norton, Kaspersky, etc. all have divisions devoted to creating viruses to keep the rest of the company profitable. Microslop has been increasingly desperate recently as they hemorrhage users. They have always been a deeply dishonest company dating back to the 90's and IP theft over GUI. I suspect they might be behind the recent push to scare the public of "the dangers" of open source and think of the kids I.D. checks.

[-] fartsparkles@lemmy.world 34 points 2 weeks ago

To everyone who isn’t wrapping themselves in aluminum, these companies don’t have teams writing viruses. This has been regurgitated around since the 90s and it’s hilariously false.

[-] fistac0rpse@fedia.io 19 points 2 weeks ago

"divisions devoted to creating viruses"

any source on this?

[-] saltesc@lemmy.world 2 points 2 weeks ago

The hunch on my back

[-] jimmy90@lemmy.world -5 points 2 weeks ago

see now when the jews invented capitalism with the catholics and were supressing mans natural instinct for communal living

ummm ummm

you know it all started there

we just need to go back to hegel and marx and that and lenin too

ok bye

[-] FreedomAdvocate@lemmy.net.au 3 points 2 weeks ago

Ah yes, Microsoft is so desperate as they hemorrhage users…….

[-] mlatu@moist.catsweat.com 10 points 2 weeks ago

ah yes, because stocks == users, thank you for the clarification

[-] AnyOldName3@lemmy.world 8 points 2 weeks ago

The stock price can mean they don't care about hemorrhaging users. Windows is far from the main thing Microsoft makes money from.

[-] FreedomAdvocate@lemmy.net.au 1 points 2 weeks ago* (last edited 2 weeks ago)

Why would they be desperate while their stock price keeps breaking all time highs?

Microsoft makes basically nothing from windows in the grand scheme of things already.

[-] mlatu@moist.catsweat.com 0 points 2 weeks ago

did i touch your "desperation" button on accident?

maybe you can help me out for a second, so i know what to reply: what exactly did i write?

[-] dotCody@lemmy.world 3 points 2 weeks ago

Ok then.

[-] dabu@lemmy.world 0 points 2 weeks ago

Because they want to discourage users and governments from switching to Linux

[+] FreedomAdvocate@lemmy.net.au -35 points 2 weeks ago

And yesterday people were making fun of Microsoft for logged in users being able to see their browser passwords 🤣

[-] BradleyUffner@lemmy.world 32 points 2 weeks ago

The thing Microsoft says is by design and won't fix? Let's see if you can spot the difference.

[-] FreedomAdvocate@lemmy.net.au -3 points 2 weeks ago

Because it isn’t an issue. If you’re signed in to your computer you can get your saved passwords by design.

[-] SirActionSack@aussie.zone 2 points 2 weeks ago

Should other software that might be running also be able to get those passwords?

PC Master Race