Sounds like a pretty major flaw in Linux. So much for Linux being way more secure than Windows. https://www.bleepingcomputer.com/ne...impacted-by-new-slubstick-cross-cache-attack/
Wow, what a mindless comment. All operating systems have been affected by side channel attacks. Judging the security of an OS just from one vulnerability makes no sense at all. Besides, the article mentions: ... which makes this issue hardly relevant in the field.
From what I understood is that it's indeed not a remote code execution (RCE) bug itself, but it can be combined with a RCE (or app that is run by user themselves locally) to bypass all security defenses in Linux in order to elevate privileges and get full control. So it's very relevant, perhaps not so much on home user systems, but it can make Linux servers way more vulnerable. So seems like a major design flaw in Linux. You must not forget that most flaws (privilege escalation) on Windows also can not magically be abused from remote, they always need to be combined with some type of flaw in a third party app (browser, PDF reader) in order to get malware up and running. That's why I have never been infected in the last 20 years of using Windows (and I didn't even patch it most of the time), for one it's easy to block browser exploits on Windows and it's much likelier that you will download some malicious app.
Actually, here is some more info. So what I meant is, Windows has many design flaws, but this one in Linux is pretty big too. And in the second link you can see in the comments that someone else noted that you really don't need physical access in order to abuse this flaw, that's not what is meant with ''you need local access.'' If you can trick someone into running some app exploit, you already have local access. Of course you still need to bypass security tools (just like on Windows), but that's why this flaw is so serious, because it makes it easier to do so. So as Linux fanboys I can understand you're trying to downplay this design flaw, but true experts know this is a pretty big one. https://linuxsecurity.com/news/security-vulnerabilities/anatomy-of-slubstick-linux-vulnerability https://www.tomshardware.com/tech-i...inux-kernel-attack-slips-past-modern-defenses
From what I've seen over the years, these doomsday vulnerabilities - for both Linux and Windows - typically and inevitably amount to nothing and fade from memory, because patches will be produced and applied to all affected OS's. Remember the Meltdown and Spectre vulnerabilities from a few years ago that were supposed to be easily weaponized to attack Intel and Arm-based processors? Well they didn't turn out be the doomsday vulnerabilities that they were hyped to be at the time.
The only person that think this is doomsday vulnerability is probably Rasheed. Or maybe even him doesn't think that, just pretending to create some drama. In other words: this is not a standalone attack. It is sort of force multiplier, when you attack different vulnerability. So the basic thing is as always: keep Linux kernel up to date with all the security fixes. Companies using commercial distributions can do this without additional downtime by using live patching. Recently this was brought up in this thread: https://www.wilderssecurity.com/thr...0-linux-cve-security-bulletins-a-week.454815/ Another thing is that any person that looked at history of memory management hardening knows this is a cat-mouse game. There will be defense for that developed, then somebody will overcome that defense, rinse and repeat.
To clarify, I never said that all Linux systems are now doomed. But it's a technical discussion, and from a technical point of view this is a major flaw. Will now all Linux systems be hacked, probably not. That's why I mentioned I have never actually been hacked on Windows in the last 20 years, eventhough from a technical point of view it's one of the most vulnerable operating systems.
For Ubuntu and Ubuntu flavors, Ubuntu Pro, including Livepatch service and Expanded Security Maintenance, is free on up to 5 machines. https://ubuntu.com/pro https://ubuntu.com/pro/tutorial
