This if f*cking scary. Such a simple code, so dangerous and it works. You can trivially add an extra root user via /etc/{passwd|shadow}. There are tons of options how to p0wn a system.
Please update your devices ASAP!
back
2 comments
Eh, it’s a limited subset of kernel versions (ones unlikely to be used in those devices), and requires local execution privileges and access to the file system. Linux in general has had numerous security issues (as has every other OS), often requiring far less access.
Does it need patching? Of course. It’s not a privilege escalation remote code execution issue though, and even if it was, it would be on a tiny fraction of running devices right now.
> and even if it was, it would be on a tiny fraction of running devices right now.
That's correct and I misjudged the situation. Sorry!
Those unsupported devices probably don't run Linux 5.8 or later, they are likely on older versions. It would be really useful to have this vuln on them though, it would help with getting root so you can get control of your own device and install your own choice of OS.
You're right, I though kernel 5.8 is a lot older than it actually is. I've edited my post.
Sorry!