Wouldn't this allow modifying a cached version of /sbin/su to nop the password c... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		MayeulC on March 7, 2022 \| parent \| context \| favorite \| on: The Dirty Pipe Vulnerability Wouldn't this allow modifying a cached version of /sbin/su to nop the password check? This seems really easy to exploit for privilege escalation.

max_k on March 7, 2022 | [–]

Yes. But you can also inject code into libc.so.6, and all running processes will have it.

staticassertion on March 7, 2022 | | [–]

Or /etc/passwd

freemint on March 7, 2022 | [–]

Yes it would. That is implied because writing arbitrary files means you can also edit the permission systems

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact