Huge Linux/polkit CVE (Vulnerability since 2009---bigger than Sequoia)

[amd6502]

It looks like red hate was responsible for this one:

https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

This vulnerability is an attacker's dream come true:
- pkexec is installed by default on all major Linux distributions (we exploited Ubuntu, Debian, Fedora, CentOS, and other distributions are probably also exploitable);
- pkexec is vulnerable since its creation, in May 2009 (commit c8c3d83, "Add a pkexec(1) command");
- any unprivileged local user can exploit this vulnerability to obtain full root privileges;
- although this vulnerability is technically a memory corruption, it is exploitable instantly, reliably, in an architecture-independent way;
- and it is exploitable even if the polkit daemon itself is not running.

 

[igor_kavinski]

More info here: https://arstechnica.com/information...s-attackers-root-on-every-major-linux-distro/

At the end, they mention a trivial mitigation command (take away polkit's executable privilege) and also how to check if a system may have been compromised.

 

[Red Squirrel]

Interesting. I recently had a server hacked and been at a lost as to how they got in. Reinstalled on a new distro as the first server was on an old one so I figured it was an old vulnerability but then even the new one was hacked again before I even had a chance to restore the backups. I then gave up at that point but now looking into trying to get my stuff up again.

Wonder if this is what was used. The attack did seem to involve running something via root as I saw really weird logs with garbage in them including a client application that is not a server, even those logs had all gibberish. I think whatever they tried to do would fail and end up corrupting memory and locking up the system, and it also broke the whole install.

Never did figure out if they stole any data, I don't think they did but still treating it like they did.

 

[ch33zw1z]

No good man, Linux runs the world behind the scenes. I'm sure there will be more migration and announcements from vendors soon