Technology

59374 readers

6264 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

Possible Linux Severe CVSS 9.9/10 Unauthenticated RCE Flaw (sh.itjust.works)

submitted 1 month ago by [email protected] to c/[email protected]

7 comments fedilink hide all child comments

Simone Margitelli's post on the find

Margitelli posted a screenshot that implies he submit this bug to Canonical and Red Hat, who rated the vulnerability to have a CVSS of 9.9. If this is true, this bug would be more critical than the infamous Heartbleed, Spectre, and Meltdown exploits. Information is really limited right now about this bug, and also somewhat contradictory. I cannot find a public statement from Red Hat or Canonical confirming the existance of this bug, but have yet to deny it. This is typical for an exploit of this magnitude. However, according to Security Online, both insitutions have confirmed its severity.

Full disclaimer, this thing could be totally overhyped/overblown right now. Its going to take a few weeks before all the information comes out. It wouldn't be the first time a vulnerability has been overhyped to pressure the dev into fixing it. In the mean time, Linux users should make sure to keep their systems up to date.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 22 points 1 month ago (2 children)

The Security Online article only cites Margitelli’s post on the matter. My assumption has been the article used the post as its single source. On one hand, watching MS fuck shit up for years, I want to believe Margitelli. On the other hand, researchers using weird tools and uninterested in reality are why curl is now a CNA.

I’m personally frustrated with Margitelli’s post because it’s all about abandoning responsible disclosure globally rather than naming and shaming (Canonical? Red Hat? Both? Others? If it affects all GNU/Linux I’d expect every single distro maintainer to be named and shamed). Responsible disclosure is our best solution to make sure innocent bystanders don’t get caught in the crossfire. When specific entities don’t abide by responsible disclosure we lambast those specific entities not the entire process built to keep users safe.

[–] [email protected] 4 points 1 month ago

I have zero knowledge about the details and processes involved in security issue disclosure and even I get the feeling something is off about Margitelli's post.

He can let his findings speak for themselves when they are responsibly disclosed (and then start the sensationalism).

[–] [email protected] 2 points 1 month ago

It'll be out in a couple of weeks and then we'll know exactly which prick has mommy issues over their code