Many Linux distributions are vulnerable in their default settings. After successful attacks, attackers could acquire root rights. In this position, they could usually completely compromise systems. Security patches are available.
Many Linux systems affected
Qualys security researchers have discovered the vulnerability (CVE-2021-33909) and published exploit code. The vulnerability affects the file system of the Linux kernel from 2014. The researchers write in a reportthat they have successfully exploited the vulnerability on Debian 11, Fedora 34 Workstation, Ubuntu 20.4 and Ubuntu 20.10. You assume that other distributions are also vulnerable.
Due to conversion errors in the file system of the kernel, local attackers would only need the 10-byte string without authentication //deleted Write to the kernel address space to get root privileges. The security researchers carry out their attack in a warning message. A classification of the threat level is currently pending.
Another loophole
The researchers also discovered a vulnerability (CVE-2021-33910) in systemd that affects many Linux systems. A classification is still pending here as well. Many Linux distributions use systemd to start system components after startup.
From a post it emergesthat an unprivileged attacker could trigger a memory error. If the DoS attack is successful, it leads to a kernel panic state. According to the researchers, the vulnerability was introduced in Systemd v220 from April 2015. To secure systems against these attacks, Linux users must ensure that their distribution is up to date.
(of)
