The Linux kernel receives an urgent update with version 7.0.8, accompanied by patches for several LTS branches. The reason is to fix the ssh-keysign-pwn vulnerability, a flaw that allowed unprivileged users to read files owned by root. The main solution includes a patch from Linus Torvalds for the ptrace get_dumpable() logic.
Torvalds' patch adjusts ptrace logic 🔧
The vulnerability exploited an error in the get_dumpable() function related to ptrace, allowing unauthorized access to sensitive data. Linus Torvalds proposed an approach that modifies the decision logic to prevent unprivileged processes from obtaining restricted information. The patch is described as a sensible adjustment, as it does not break existing functionalities and cleanly closes the security hole. The affected LTS branches already have their respective backports.
Root is no longer an open mailbox 📬
It turns out that having root privileges wasn't very useful if anyone could read its files as if they were class notes. The flaw turned the superuser into the neighbor who leaves the door open. Now, with Torvalds' patch, root files are once again as secure as a safe with a forgotten password. Good thing the patch arrived before someone read the kernel's shopping list.