• HeyLow (she/her)🏳️‍⚧️@lemmy.blahaj.zone
    link
    fedilink
    arrow-up
    18
    arrow-down
    7
    ·
    1 day ago

    Oh wow another overblown privilege escalation bug that REQUIRES pre-existing access to a machine in order to actually be used. If someone has enough access to my machines to execute this they already have likely pwned all the information they want without needing root at all…

    • ISO@lemmy.zip
      link
      fedilink
      arrow-up
      9
      arrow-down
      1
      ·
      edit-2
      20 hours ago

      LPE is in the title. And you sound like someone who doesn’t know what that stands for.

      This also comes with a good public write-up on github (not some monetized fancy domain), with an explanation why it went public early, which wasn’t their fault.

      There is a lot of intelligence insulting going on in the security theater industry, which is something I talked about here more than once, despite not being exactly a prolific commentator. But unfortunately for you, this particular case is one of the least offensive.

    • Ooops@feddit.org
      link
      fedilink
      arrow-up
      3
      ·
      19 hours ago

      That may be true for private machines, but having user access to a machine, yet not be allowed admin rights is not actually a rare setup in the wild (read: servers… where the actual money is, not on that boring thing sitting under your desk)

    • Solemarc@lemmy.world
      link
      fedilink
      arrow-up
      14
      ·
      1 day ago

      It is a bit eye rolling “LOOK AT THIS DISASTER OF AN EXPLOIT!!!” *Requires physical access to the machine

      But the major issue is that if you have some other exploit that gets you RCE or a shell you can then use these exploits to pwn someone and we have RCE’s and shell exploits come around all the time.

    • lengau@midwest.social
      link
      fedilink
      arrow-up
      7
      ·
      1 day ago

      Desktop machines aren’t really the target of these kinds of attacks.

      Also I think the author in this case seems to have been pretty reasonable about what they did. If more of these issues were done this way I wouldn’t have nearly as much irritation about “branded bugs.”