It’s a privilege escalation vulnerability:
Linux users on Tuesday got a major dose of bad news — a 12-year-old vulnerability in a system tool called Polkit gives attackers unfettered root privileges on machines running most major distributions of the open source operating system.
Previously called PolicyKit, Polkit manages system-wide privileges in Unix-like OSes. It provides a mechanism for nonprivileged processes to safely interact with privileged processes. It also allows users to execute commands with high privileges by using a component called pkexec, followed by the command.
It was discovered in October, and disclosed last week — after most Linux distributions issued patches. Of course, there’s lots of Linux out there that never gets patched, so expect this to be exploited in the wild for a long time.
Of course, this vulnerability doesn’t give attackers access to the system. They have to get that some other way. But if they get access, this vulnerability gives them root privileges.
More Stories
Smashing Security podcast #369: Keeping the lights on after a ransomware attack
Leicester City Council suffers a crippling ransomware attack, and a massive data breach, but is it out of the dark...
US Congress Passes Bill to Ban TikTok
The bill that could see TikTok banned in the US has been approved by the House of Representatives and the...
How to Tell If Your Text Message Is Real
According to reports from the Federal Trade Commission’s Consumer Sentinel database, text message scams swindled $372 million from Americans in...
US Sanctions Iranian “Fronts” for Cyber-Attacks on American Entities
The US Treasury announced sanctions on two companies and four individuals for cyber campaigns conducted on behalf of the Iranian...
Leeds Talent Pool Attracts BlueVoyant’s First UK Security Operations Center
The proximity of organizations’ headquarters, like Asda’s and NHS England’s, prompted BlueVoyant to choose Leeds as the location for its...
City street lights “misbehave” after ransomware attack
The UK's Leicester City Council was thrown into chaos last month when a crippling cyber attack forced it to shut...