Just a moment...
www.bleepingcomputer.com
  • misk@piefed.socialEnglish
    131·
    3 days ago

    Those root privileges being able to edit a root-owned file if it’s in a directory that allows writes by all users. How common is that?

    Saeed Abbasi, the head of Qualys’ Threat Research Unit, says the discovery emerged from a research initiative between Qualys and Anthropic, in which researchers integrated the AI model Claude Mythos Preview into their manual audit workflow.

    Ah, an ad.

    • fruitcantfly@programming.dev
      11·
      3 days ago

      Those root privileges being able to edit a root-owned file if it’s in a directory that allows writes by all users. How common is that?

      The file doesn’t need to be in a world-writable directory, there just needs to be a (world-)writable directory on the same partition, such as /tmp on the root partition. The attacker then uses a XFS specific feature (reflink) to create a clone of the target file (e.g. /etc/passwd) in the writable directory, and then they can modify the content of the target file via their clone due to the race-condition

      The advisory has a more detailed description: https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt

      • misk@piefed.socialEnglish
        51·
        3 days ago

        Why would you use XFS for those partitions in the first place? It’s not what it was designed for or used in real life and that’s likely reason this wasn’t discovered before. What I’m getting from a lot of those AI-assisted security findings is that they’re not concerned with a real vector of attack before making big claims in the media. You’ll probably be able to vandalise things with this exploit but „root privileges” is pushing it.

        • fruitcantfly@programming.dev
          9·
          3 days ago

          XFS is the default filesystem for RHE, and while I believe that /tmp is a tmpfs on RHE and should therefore be safe, it is my understanding that /var/tmp needs to be accessible on boot and is therefore typically on the root FS. EDIT: Can confirm for the RHE server I have access to, that this is the case

          • misk@piefed.socialEnglish
            2·
            2 days ago

            I’m seriously behind times because I’m reading RHEL switched to XFS as a default in 2013 and SUSE did that even earlier :o

            I don’t even need an LLM to be confidently wrong, sorry.

          • fruitycoder@sh.itjust.works
            4·
            2 days ago

            /Var /Var/logs /Var/tmp /Tmp / /Home /Boot

            Can all be separate partitions on an Enterprise Linux system. Cisa guidelines recommend some and additional mount configs since they have different roles

            • fruitcantfly@programming.dev
              3·
              2 days ago

              Those can all be separate partitions on any Linux system. But defaults matter, and if the defaults are insecure then you can expect most systems to be insecure