28
New RefluXFS Linux flaw lets attackers gain root privileges (www.bleepingcomputer.com)
submitted 3 months ago by to c/linux@programming.dev
7 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 10 points 3 months ago (6 children)

Those root privileges being able to edit a root-owned file if it’s in a directory that allows writes by all users. How common is that?

Saeed Abbasi, the head of Qualys' Threat Research Unit, says the discovery emerged from a research initiative between Qualys and Anthropic, in which researchers integrated the AI model Claude Mythos Preview into their manual audit workflow.

Ah, an ad.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 11 points 3 months ago* (5 children)

    Those root privileges being able to edit a root-owned file if it’s in a directory that allows writes by all users. How common is that?

    The file doesn't need to be in a world-writable directory, there just needs to be a (world-)writable directory on the same partition, such as /tmp on the root partition. The attacker then uses a XFS specific feature (reflink) to create a clone of the target file (e.g. /etc/passwd) in the writable directory, and then they can modify the content of the target file via their clone due to the race-condition

    The advisory has a more detailed description: https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 3 points 3 months ago* (4 children)

    Why would you use XFS for those partitions in the first place? It’s not what it was designed for or used in real life and that’s likely reason this wasn’t discovered before. What I’m getting from a lot of those AI-assisted security findings is that they’re not concerned with a real vector of attack before making big claims in the media. You’ll probably be able to vandalise things with this exploit but „root privileges” is pushing it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 9 points 3 months ago* (last edited 3 months ago) (3 children)

    XFS is the default filesystem for RHE, and while I believe that /tmp is a tmpfs on RHE and should therefore be safe, it is my understanding that /var/tmp needs to be accessible on boot and is therefore typically on the root FS. EDIT: Can confirm for the RHE server I have access to, that this is the case

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 3 months ago (1 child)

    /Var /Var/logs /Var/tmp /Tmp / /Home /Boot

    Can all be separate partitions on an Enterprise Linux system. Cisa guidelines recommend some and additional mount configs since they have different roles

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 3 months ago* (last edited 3 months ago)

    I’m seriously behind times because I’m reading RHEL switched to XFS as a default in 2013 and SUSE did that even earlier :o

    I don’t even need an LLM to be confidently wrong, sorry.

  • permalink
  • fedilink
  • source
  • parent