Linux system service bug gives you root on every major distro

[Corrine]

From Bleeping Computer at Linux system service bug gives you root on every major distro:

Quote

A vulnerability in Polkit's pkexec component that is present in the default configuration of all major Linux distributions can be exploited to gain full root privileges on the system, researchers warn today.

Identified as CVE-2021-4034 and named PwnKit, the security issue has been tracked to the initial commit of pkexec, more than 12 years ago, meaning that all Polkit versions are affected.

Part of the Polkit open-source application framework that negotiates the interaction between privileged and unprivileged processes, pkexec allows an authorized user to execute commands as another user, doubling as an alternative to sudo.

Easy to exploit, PoC expected soon

Researchers at Qualys information security company found that the pkexec program could be used by local attackers to increase privileges to root on default installations of Ubuntu, Debian, Fedora, and CentOS.

They warn that PwnKit is likely exploitable on other Linux operating systems as well

Additional information at the above-linked article.

 

[xrobwx71]

Yeah but..... <snicker> Just kidding.

 

[britechguy]

So much for Fortress Linux! Not that I ever believed there is Fortress Any OS.

Hacks are equally dependent on actual vulnerabiities that can be exploited, ubiquity of the OS (more is better), and the probability of a payoff.

In the case of Linux (all distros) versus Windows the numbers tell the story. You target where you have the most opportunities to "hit the jackpot," and that's not Linux.

I fully expect this will be patched, pronto.