News CVE-2024-53104 Linux Kernel Out-of-Bounds Write Vulnerability

[DJones]

Critical Linux 0-Day Attack Warning: U.S. Government Says Act Now

As critical Linux attacks are confirmed, the Department of Homeland Security warns users to update now.

www.forbes.com

NVD - CVE-2024-53104

nvd.nist.gov

cve-details

~ Redhat

Overall the risk in my opinion is low for everyday users, and would require a physical or virtual usb device with infected vulnerable code to execute on a Linux machine. Likely this code would have to come from a already vulnerable device. Not a security researcher so this is just from what I’ve read.

 

[bbunge]

Once again Forbes writes an article that the sky is falling. As I see it, Linux kernel 2.5.26 is affected and the warning was to US Government Agencies.

 

[dave14305]

It’s like getting investment advice from Hacker News…

 

[DJones]

Once again Forbes writes an article that the sky is falling. As I see it, Linux kernel 2.5.26 is affected and the warning was to US Government Agencies.

Yep. News articles sensationalize everything, this isn’t surprising to me what so ever. It’s a valid 0-day, but it’s not a concern for 99.9% of home users even android. For sysadmins in government or datacenters this could be a concern, but the physical nature of the penetration would mean it’s a targeted attack and you probably have bigger concerns at hand.

 

[Digilog]

The press is out of touch with reality, but Red Hat should have released updates by now. Currently stable versions are 6.12.13 and 6.13.2 experimental is now 6.14 rc2

So they should have updated to the latest version of their subsystem which would be 6.12.13. This CVE was fixed in 6.12 rc8

 

[sfx2000]

Vuln's like this are more about a chain of attacks - e.g. peeling things up a step at a time...

Not all Linux distros are on the same timelines for mitigations - some might have it covered already, some might not.

 

[Digilog]

Not all Linux distros are on the same timelines for mitigations - some might have it covered already, some might not.

Redhat is kind of a different animal as it behind a little in the update timeline compared to the experimental platform Fedora. Plus I think they leave their system buggy so they can get people to pay for their support.

 

[jerry6]

the sky is always falling these days , it gets clicks sell print . Anything to make a buck