The Slop-Amplified Fear of Privilege Escalation (Local, Not Remote) in Linux, the Kernel
This article will not belittle security, but it will put things in some much-needed perspective.
Lately there were a couple of bugs found (one prematurely talked about due to carelessness and lack of coordination with self-serving opportunists who profit from a sense of risk) in Linux - the kernel, proper, but not 'core' parts - and both of them got branded, which in the more distant past (pre-IBM) Red Hat complained about. It asserted that logos and catchy names meant lots of media hype would follow, irrespective of the real severity or objective underlying risk/s. One of the brands can cover two separate bugs (but interconnected). To quote one site: "Dirty Frag is a vulnerability chain combining two page-cache write primitives in the Linux kernel: one in the xfrm-ESP (IPsec) subsystem..." (link omitted due to sensationalism)
I used IPsec for a number of years but have not had it installed for over half a decade. As noted in IRC earlier today, there is more impact for some than for others. In many use cases (for servers, desktops, gadgets), this is not relevant. A week ago it already 'leaked' that AFS was impacted and "AFS had a lot of file ACL commands to let any user create an AFS ACL and put 4 group project members in..."
How many people still use AFS and how easy is it to access AFS-linked code?
Quoting the Linux Mint forums: "I guess I'm just wondering *exactly* how vulnerable the normal user is to this exploit? Not saying it's not important, but what is the probability that a single user workstation can be affected by this? The mitigation is fairly simple, so that's a relief."
So now there is a patch and there will be many more patches anyway. Many more. Linux gets patched all the time. How many people should be frantic about it and reboot ASAP? As someone in the forums put it: "Also, please note, to be affected by this vulnerability, you need a malicious local user capable to access your computer. That quite a theoretical possibility for most of us."
We are not downplaying those bugs, but we feel like one of them (the first) was creating lots of hype because it was allegedly a slop-attributed one (allegedly; we cannot know for sure and it is not wise to guess); we were all along being privately practical about this and rebooted when the patch became available. To be clear, local privilege escalation bugs will never be a huge deal like authentication bypass over SSH.
The pair of bugs (above) are not as critical as the media wants us to believe. The first is not 10.0 (rating for severity), not even 9.0. It is probably OK to apply that and reboot, but on many systems it is not imperative. As I explained earlier today to a peer, it very unlikely that a new PM (Perl Module) in Debian will contain an exploit for this (which can moreover be potently planted, then subsequently leveraged). It's also unlikely that any of the local users on our systems will get all nasty (or that Rianne will decide to become root; which she can regardless). And so in "realworld" terms, we prefer to put it in perspective and combat some of the media hype, which is heavy on brands and buzzwords (a lot talks about "AI").
If remote exploitation is very unlikely, and if the local users are trusted (or have physical access to the system), what is the complete risk model?
If someone trusted ends up putting bad/malicious files on the system (and it is not possible to run them without root), either maliciously or ignorantly, then the true damage is contained. In our case, we need not worry about the upstream doing so because we don't use Microsoft NPM or something like that; that's because the system is managed via Debian repos and we don't use some bloated CMS crapwares (they often rely on PHP crapware or user-side uploaders for various users, which we lack; that's how malicious files often get planted/placed onto systems).
"I have not been able to cut through the hype to find the nature of that particular patch," an associate said.
For nearly a week now people wait to find out what this was all about. Uncertainly contributed to the panic.
Weeks ago Anthropic (evil company that coerces institutions into doing marketing for it) said a model was too dangerous to release. Then it leaked. And nothing happened.
The same goes for this latest bug, which has a brand and a logo (Tux, the Linux mascot having just turned 30, holding a grenade).
Did this live up to the hype? It relates to kernel subsystems like VPN (which not many people use at all) and for most people, with typical use cases, this does not pose a risk. They don't have "evil maid" accounts and they use only simple software. Their VPN - if any - does not live in the kernel or hijacks the network stack.
Since a lot of today's news sites are weak on research and some became slopfarms (just parroting those poorly-researched utterances about "Linux") we are meant to assume this is no better and no worse than Microsoft intentionally putting back doors in everything, even encryption. █