I love how every time I read a "Critical" vulnerability in Linux it's essentially "The user must leave their computer completely unlocked in an accessible area for a long period of time. Also he needs this very specific combination of programs running in these specific versions. Ah, and the planets have to be aligned for it to work. If all of these happen, an attacker might glimpse at your desktop wallpaper, so definitely critical".
not trying to sound like an internet badass but if I find someone in my home fucking with my config files I will kill them with a hammer
I would at the very least break their fingers if they touch my keyboard.
No hammer needed...
This made me think of a custom keyboard with a mousetrap arm at the top to break the fingers of would-be typers.
My first reaction would be to acknowledge them as a fellow geek, but that's because most of the people who live near me would hurt themselves trying to open Notepad. Anyone who knows enough to start hacking my config files would be a welcome guest in my house.
clickbait title. basically, if your machine is already compromised in a severe way, here is another way how to compromise it further (for whatever reason)
And the issue that does exist doesn't even require Linux to be installed, technically. Unless you're an IT pro administering large numbers of systems that boot from a network disk image, there is nothing for you to worry about here.
It's also a new way to compromise a machine you have physical access to
I wonder if Matt calculated CVSS score before calling this vulnerability "critical".
It’s the last sentence of the article - 9.8/10. In this case it’s probably called critical because of the potential consequences of the exploit being a full machine takeover, not the likeliness of the exploit being used.
It means that CVSS is calculated wrong. It can't be so big because default configuration is not affected and attacker requires admin access to change it.
I mean take a look at the report. Still not sure how it’s “wrong”.
Linux developers are in the process of patching a high-severity vulnerability that, in certain cases, allows the installation of malware that runs at the firmware level, giving infections access to the deepest parts of a device where they’re hard to detect or remove.
The vulnerability resides in shim, which in the context of Linux is a small component that runs in the firmware early in the boot process before the operating system has started.
While these hurdles are steep, they’re by no means impossible, particularly the ability to compromise or impersonate a server that communicates with devices over HTTP, which is unencrypted and requires no authentication.
These particular scenarios could prove useful if an attacker has already gained some level of access inside a network and is looking to take control of connected end-user devices.
In that case, the attacker would first have to forge the digital certificate the server uses to prove it’s authorized to provide boot firmware to devices.
And, of course, already obtaining administrative control through exploiting a separate vulnerability in the operating system is hard and allows attackers to achieve all kinds of malicious objectives.
The original article contains 493 words, the summary contains 189 words. Saved 62%. I'm a bot and I'm open source!
“An attacker would need to be able to coerce a system into booting from HTTP if it's not already doing so, and either be in a position to run the HTTP server in question or MITM traffic to it,” - Matthew Garrett
Summary left out a quite important bit.
Security people sure are an enthusiastic bunch of fellows.
high-severity
Is not the same as "critical"
2 scenarios where it can be exploited:
Acquiring the ability to compromise a server or perform an adversary-in-the-middle impersonation of it to target a device that’s already configured to boot using HTTP
Already having physical access to a device or gaining administrative control by exploiting a separate vulnerability.
I love how every time I read a "Critical" vulnerability in Linux it's essentially "The user must leave their computer completely unlocked in an accessible area for a long period of time. Also he needs this very specific combination of programs running in these specific versions. Ah, and the planets have to be aligned for it to work. If all of these happen, an attacker might glimpse at your desktop wallpaper, so definitely critical".
not trying to sound like an internet badass but if I find someone in my home fucking with my config files I will kill them with a hammer
I would at the very least break their fingers if they touch my keyboard.
No hammer needed...
This made me think of a custom keyboard with a mousetrap arm at the top to break the fingers of would-be typers.
Mousetrap keyboard + Suicide Linux
But I bet it's more fun with a hammer.
But you could damage the keyboard
Not my Model M.
The Model M IS the weapon
That's collateral damage I'm willing to risk 🤣
My first reaction would be to acknowledge them as a fellow geek, but that's because most of the people who live near me would hurt themselves trying to open Notepad. Anyone who knows enough to start hacking my config files would be a welcome guest in my house.
Then I'd kill them with a hammer. :-)
clickbait title. basically, if your machine is already compromised in a severe way, here is another way how to compromise it further (for whatever reason)
And the issue that does exist doesn't even require Linux to be installed, technically. Unless you're an IT pro administering large numbers of systems that boot from a network disk image, there is nothing for you to worry about here.
It's also a new way to compromise a machine you have physical access to
I wonder if Matt calculated CVSS score before calling this vulnerability "critical".
It’s the last sentence of the article - 9.8/10. In this case it’s probably called critical because of the potential consequences of the exploit being a full machine takeover, not the likeliness of the exploit being used.
It means that CVSS is calculated wrong. It can't be so big because default configuration is not affected and attacker requires admin access to change it.
I mean take a look at the report. Still not sure how it’s “wrong”.
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-40547&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1&source=NIST
Admin or physical access.
This is the best summary I could come up with:
Linux developers are in the process of patching a high-severity vulnerability that, in certain cases, allows the installation of malware that runs at the firmware level, giving infections access to the deepest parts of a device where they’re hard to detect or remove.
The vulnerability resides in shim, which in the context of Linux is a small component that runs in the firmware early in the boot process before the operating system has started.
While these hurdles are steep, they’re by no means impossible, particularly the ability to compromise or impersonate a server that communicates with devices over HTTP, which is unencrypted and requires no authentication.
These particular scenarios could prove useful if an attacker has already gained some level of access inside a network and is looking to take control of connected end-user devices.
In that case, the attacker would first have to forge the digital certificate the server uses to prove it’s authorized to provide boot firmware to devices.
And, of course, already obtaining administrative control through exploiting a separate vulnerability in the operating system is hard and allows attackers to achieve all kinds of malicious objectives.
The original article contains 493 words, the summary contains 189 words. Saved 62%. I'm a bot and I'm open source!
“An attacker would need to be able to coerce a system into booting from HTTP if it's not already doing so, and either be in a position to run the HTTP server in question or MITM traffic to it,” - Matthew Garrett
Summary left out a quite important bit.
Security people sure are an enthusiastic bunch of fellows.
Is not the same as "critical"
2 scenarios where it can be exploited:
Acquiring the ability to compromise a server or perform an adversary-in-the-middle impersonation of it to target a device that’s already configured to boot using HTTP
Already having physical access to a device or gaining administrative control by exploiting a separate vulnerability.