Daniel Baumann: Debian: Linux Vulnerability Mitigation (ssh-keysign-pwn) (opens in new tab)

Covers 0xdeadbeefnetwork/ssh-keysign-pwn: Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.

After the Linux local root privilege escalations of the last two weeks, the one of today is ssh-keysign-pwn [no CVE yet] which allows read root-owned files as an unprivileged user. I’ve cherry-picked the upstream commit to fix it in trixie-fastforward-backports (linux 7.0.4-1 backports for trixie) and confirmed that the exploits don’t work anymore.

Read the original article