Selfhosted

63,680 readers

5,234 active

545 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

moderation log

moderators

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Dirty Frag: Universal Linux LPE - CVE similar to Copy Fail (www.openwall.com)

submitted 6 months ago by eager_eagle@lemmy.world to c/selfhosted@lemmy.world

4 comments fedilink hide all child comments

Local Privilege Escalation "Dirty Frag" made public

https://www.openwall.com/lists/oss-security/2026/05/07/8

https://thehackernews.com/2026/05/linux-kernel-dirty-frag-lpe-exploit.html

https://safecomputing.umich.edu/security-alerts/linux-kernel-vulnerability-%E2%80%9Cdirty-frag%E2%80%9D

https://www.bleepingcomputer.com/news/security/new-linux-dirty-frag-zero-day-with-poc-exploit-gives-root-privileges/

you are viewing a single comment's thread
view the rest of the comments

[–] irmadlad@lemmy.world 14 points 6 months ago (3 children)

RFC: As I understand it this exploit requires local access and cannot be deployed remotely. Is this a correct analysis?

permalink

fedilink

source

hideshow 3 child comments

[–] eager_eagle@lemmy.world [S] 12 points 6 months ago (1 child)

right, but remote code execution comes in many different ways. Having a machine vulnerable to this kind of privilege escalation is a really bad thing.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] irmadlad@lemmy.world 5 points 6 months ago

Certainly. I don't discount that any exploit is 'really bad'. I like my OS of choice to be as free of exploits as it can possibly be. However, some of the material I was reading involved areas of Linux that I have little if any knowledge of value with, so I thought I'd as the question.

permalink

fedilink

source

parent

[+] ShortN0te@lemmy.ml 1 point 6 months ago (1 child)

[deleted]

permalink

fedilink

source

parent

hideshow 1 child comment

[–] Mondez@lemdro.id 9 points 6 months ago

It's a LOCAL privilege escalation vulnerability. You need sufficient access to be able to execute arbitrary code locally on the machine. You would need a remote code execution vulnerability in an exposed service (VPN, web server, game server and so on) before an attacker could chain to this to get remote root on your system.