A local root vulnerability in glibc [LWN.net]

A local root vulnerability in glibc

Posted Oct 4, 2023 17:00 UTC (Wed) by mokki (subscriber, #33200)
In reply to: A local root vulnerability in glibc by taladar
Parent article: A local root vulnerability in glibc

Or a developer just runs npm install or pip install, both of which download transitively a number of dependencies any of which can be modified to run whatever commands they want to on the system.
Previously the packages could "only" install upload users secrets. With this vulnerability they can take over the whole system.

to post comments

A local root vulnerability in glibc

Posted Oct 4, 2023 17:21 UTC (Wed) by mb (subscriber, #50428) [Link]

Taking over the whole system vs. taking over the user's account is largely the same thing for the vast majority of personal machines.

I don't care, if somebody takes my /usr/bin/bash and uploads it to somewhere. I don't even care that much, if some attacker deletes my /usr/bin/bash. And I don't care that much, if the attacker replaces /usr/bin/bash with malware. Everything is lost already anyway.

The problem is if somebody gains access to my /home/user. And that happens at the point where I download and execute malicious programs. Not where these programs exploit a setuid vulnerability.