Two Linux vulnerabilities introduced recently into the Ubuntu kernel create the potential for unprivileged local users to gain elevated privileges on a massive number of devices.
  • @hygieia@feddit.nl
    100•11 months ago

    CVE-2023-2640 and CVE-2023-32629 if you don’t fancy spending an age clicking Object to all the ‘legitimate interest’ cookie shit.

    • @maiskanzler@feddit.de
      -1•11 months ago

      Tip: “I still don’t care about cookies” for desktop browsers + deleting all cookies at the end of the browser session works flawlessly for me.

  • Yewb
    31•11 months ago

    CVE-2023-2640

    Needs a user account on the system (even unprivledged accounts) via overlayfs

    Overlayfs allows one, usually read-write, directory tree to be overlaid onto another, read-only directory tree. All modifications go to the upper, writable layer. This type of mechanism is most often used for live CDs but there is a wide variety of other uses.

    • style99
      13•11 months ago

      In this case, it’s more like the opposite. People testing the cutting edge versions of Ubuntu are the ones impacted.

  • astraeus
    13•11 months ago

    Couldn’t find whether this even impacts LTS builds. Either way, seems like patching should resolve the issue

  • Roq
    9•11 months ago

    @leo what’s the solution, is it just the normal apt update/upgrade or something more complicated? And is it possible to know if a machine has suffered such attack at all?

    • LeoOPA
      12•11 months ago

      According to the Ubuntu bulletin, a simple update is sufficient.

      The Wiz announcement didn’t really go into specifics, so not sure other than normal user auditing.