Post B4MYeOqhf6haAu7xVA by civodul@toot.aquilenet.fr
(DIR) More posts by civodul@toot.aquilenet.fr
(DIR) Post #B4MV8DP0Ny2VXo8KoK by civodul@toot.aquilenet.fr
0 likes, 0 repeats
Looks like removing files from /tmp on a running system is racy and risky:https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-rootSomeone on oss-sec shared a very similar issue from 2002 (‘tmpwatch’ instead of ‘systemd-tmpfiles’):https://lcamtuf.coredump.cx/tmp_paper.txt
(DIR) Post #B4MWktxYhsZAUYJ4HA by lanodan@queer.hacktivis.me
0 likes, 0 repeats
@civodul Yeah although it's not really the removal that's an issue here, and more like how /tmp shouldn't be used for privileged data and executables at all.
(DIR) Post #B4MYXnYpO0Nmn1cPM8 by zimoun@sciences.re
0 likes, 0 repeats
@civodul My favorite quote:« […] reviewing the uutils coreutils package (a Rust rewrite of standard GNU utilities).A race condition in the rm utility allowed an unprivileged local attacker to […]The default rm command in Ubuntu 25.10 was reverted to GNU coreutils to mitigate this risk immediately. »
(DIR) Post #B4MYXnqYK6YpfzuYz2 by Profpatsch@mastodon.xyz
0 likes, 0 repeats
@zimoun @civodul lol, I’m surprised this is news to a greybeard like Civodul, it’s one of the earliest unix attacks I think
(DIR) Post #B4MYXo1XfFLqE53L72 by civodul@toot.aquilenet.fr
0 likes, 0 repeats
@Profpatsch @zimoun Heh, not really news, but I found the combination of systemd-tmpfiles and snap-confine particularly creative here. (And the Qualys writeups are always this good!)
(DIR) Post #B4MYeOqhf6haAu7xVA by civodul@toot.aquilenet.fr
1 likes, 0 repeats
@zimoun I considered badmouthing on uutils but found it too simple. :-)
(DIR) Post #B4NzjTTamFittVvCJk by raito@nixos.paris
0 likes, 0 repeats
@civodul exactly what Lix or Guix got affected by a while ago :p