The world’s main Linux distros have launched patches to handle a safety flaw impacting practically all of them.
“Looney Tunables” is a GNU C Library (glibc) privilege escalation exploit that grants native customers full root entry. The flaw was found by safety researchers at Qualys. Due to glibc’s widespread use, the overwhelming majority of distributions are affected by this specific flaw, in line with Saeed Abbasi, Product Supervisor – Menace Analysis Unit:
We’ve efficiently recognized and exploited this vulnerability (an area privilege escalation that grants full root privileges) on the default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13. It’s doubtless that different distributions are equally vulnerable, though we’ve famous that Alpine Linux stays an exception attributable to its use of musl libc as a substitute of glibc. This vulnerability was launched in April 2021.
Abbasi says the vulnerability poses “vital dangers” to Linux distributions and their customers:
Our profitable exploitation, resulting in full root privileges on main distributions like Fedora, Ubuntu, and Debian, highlights this vulnerability’s severity and widespread nature. Though we’re withholding our exploit code for now, the benefit with which the buffer overflow may be remodeled right into a data-only assault implies that different analysis groups may quickly produce and launch exploits. This might put numerous techniques in danger, particularly given the intensive use of glibc throughout Linux distributions. Whereas sure distributions like Alpine Linux are exempt attributable to their use of musl libc as a substitute of glibc, many fashionable distributions are doubtlessly susceptible and could possibly be exploited within the close to future.
Thankfully, Debian, Gentoo, Ubuntu, and Pink Hat have already patched the problem. For sure, customers ought to replace instantly.
