[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <a508afdc-888b-45cd-b479-9601a833acfe@gmail.com>
Date: Tue, 16 Dec 2025 19:43:24 -0600
From: Jacob Bachmeyer <jcb62281@...il.com>
To: oss-security@...ts.openwall.com, turistu@...il.com
Subject: Re: [CVE-2025-14282] dropbear: privilege escalation
via unix domain socket forwardings
On 12/16/25 08:27, turistu@...il.com wrote:
> [...]
>
> But this dbus/systemd thing is only meant as illustration; there are plenty
> of other ways to (ab)use this; in particular, xwayland / recent linux distros
> have gutted the X11 cookie auth, only relying on "si:localuser" (i.e. on
> SO_PEERCRED checks) for authentication.
This looks to me like the problem here is systemd and wayland offering
abusable endpoints and distributions intentionally weakening security.
Gutting X11 cookie auth is *completely* *inexcusable* in a networked
environment. Could that itself qualify for a CVE on all distributions
that do it?
-- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
