Fragnesia Made Public As Latest Linux Local Privilege Escalation Vulnerability

[f33dm3bits]

Fragnesia Made Public As Latest Linux Local Privilege Escalation Vulnerability - Phoronix

www.phoronix.com

 

[PuppyHome]

".........and still they come".

The list is growing fast, guys.

 

[CaffeineAddict]

What we see is what was made public, but what about what we don't see?
black hats don't share their exploits.

Every code addition to existing software/package is new potential for attackers.

 

[kc1di]

Thanks for the warning

 

[piorunz]

It's only local, just like two previous ones. Nothing to worry about, unless you share your computers or run a business.

 

[CaffeineAddict]

It's only local, just like two previous ones. Nothing to worry about

I wouldn't be so relaxed, you should treat your non root account (one which you use every day) as one that's always hacked.
If you think so then it's no longer local.

non root account can be compromised at any time while you browse the net, you don't have to install anything, just surf random sites on the web, that's enough.

That's why I run my browser session in a VM, what ever happens it happens to just one file, the VHD, but system is un-touchable.

edit:
Technically VM isolation can be hacked as well but likelyhood is small.

 

[piorunz]

I wouldn't be so relaxed, you should treat your non root account (one which you use every day) as one that's always hacked.
If you think so then it's no longer local.

non root account can be compromised at any time while you browse the net, you don't have to install anything, just surf random sites on the web, that's enough.

That's why I run my browser session in a VM, what ever happens it happens to just one file, the VHD, but system is un-touchable.

Good protection. I run my browser in firejail, that's good too.
in my scenario, it's very unlikely that malicious browser script will:

• defeat browser sandboxing
• defeat firejail sandboxing
• find open local privilege escalation and exploit to gain root.

So, that's why I said, nothing really to worry about. I guess my hard drive will die sooner than I will get ransomwared or hacked.
But it that ever happens, I will treat it as hard drive failure, will wipe system clean, and restore from backup, reinstall and re-create my files.
I don't run a lot of random code on my machine either, I always try to use system repositories maintained by distro, only if that's not available, I look for Flatpak or package from software developer.

 

[Condobloke]

Fragnesia is a member, of the Dirty Frag vulnerability class. This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag.

 

[The Duck]

I don't even run a hard drive.

I load from USB flash drive to ram and run completely from ram.

It's call "Ram Only Mode" no hard drive exist 100% HDD isolation.

Any bad happens reboot and get a clean new install everytime.

Easy OS no other Linux distro like it

 

[Smilax]

But it that ever happens, I will treat it as hard drive failure, will wipe system clean, and restore from backup, reinstall and re-create my files.
I don't run a lot of random code on my machine either

I'm far more likely to booger up my own system. Every couple of years I do it to myself anyway, just for a clean install. Lots of odd code gets left behind and that's good. I'm not being nonchalant about security (I won't click on a YT video I'm so paranoid) but other than being angry at getting had, it would be no different than my nvme fritzing out or my PC getting struck by lightning, which does happen here. Nothing that matters to me lives on that device very long if at all. I'm a Timesynch believer with a dedicated separate disk and an ambitious backup schedule. I have almost never had to use it, but it's there and it's easy and it's cheap. And just this week, by virtue of hanging out here, I learned about Rescuezilla. I highly recommend it.

When I was selling and installing Netware systems, server drives were pricey. It was difficult trying to convince a customer why it was a good idea to purchase an additional drive(s) so his OS and data weren't on the same physical device. Sometimes It added a thousand bucks or more to a system for something they couldn't see. But it was sound design policy for many reasons and has always stuck with me.

Anyway, my hardware isn't special, not enough RAM for VMs, and sata drives are cheap. I don't store anything I want to keep on my system drive. It's an easy afternoon rebuild and my data is somewhere else.