Lots of privilege escalations these days. But are there that many multiuser Linux systems nowadays ? I'm under the impression the whole landscape is either servers or single-user desktops (and ofc Android phones).

▲

INTPenis 5 hours ago | parent | next [-]

The idea is that you can exploit a service hosted on Linux to run these.

▲

zahlman 5 hours ago | parent | prev | next [-]

I impersonate multiple users on my machine for organizational reasons.

LPEs also potentially make user-level malware into system-level malware, which is only marginally more impactful for a single person on a desktop, but considerably harder to clean up. (It also broadens the range of what such malware could exfiltrate from me.)

▲

dathinab 4 hours ago | parent | prev | next [-]

> many multiuser Linux systems nowadays

not relevant IMHO

we don't live anymore in a time where you can trust that local apps do not misbehave, and in such a context LPE is pretty bad even in a single user system

just thing about all the supply chain problems of recent times

▲

bestouff 3 hours ago | parent [-]

I would say that in a single-user system LPE isn't even needed. The moment you run malicious code all bets are off. No need to compromise the system when all your data is under "enemy" control.

	▲	gnufx 35 minutes ago \| parent \| next [-]
		You might not have root on an organizational "managed" system.
	▲	fluffybucktsnek an hour ago \| parent \| prev [-]
		Technically, running malicious code doesn't necessarily give control over all your data in the device. But common Linux is still lacking in sandboxing practicality, so it might as well be that way.

▲

riedel 4 hours ago | parent | prev [-]

Many university HPC clusters are run multiuser. At least login nodes.

	▲	gnufx an hour ago \| parent [-]
		Any university or national HPC system as I'd understand the term is multi-user. There are also things like the extensive high energy physics WLCG compute federation, which is somewhat different, but can potentially be compromised quickly at large scale. For the original copy-fail we didn't want to drain our WLCG Alma9 cluster, or just kill all the jobs like the university HPC system. We got eBPF mitigation in place within a couple of hours, relieved the exploit signature wasn't in logs from the night before. That would have been done earlier if Proofpoint hadn't bounced the forwarded oss-security article as "contains malware"; sigh.