Acquiring the ability to compromise a server or perform an adversary-in-the-middle impersonation of it to target a device that’s already configured to boot using HTTP
Already having physical access to a device or gaining administrative control by exploiting a separate vulnerability.
clickbait title. basically, if your machine is already compromised in a severe way, here is another way how to compromise it further (for whatever reason)
And the issue that does exist doesn’t even require Linux to be installed, technically. Unless you’re an IT pro administering large numbers of systems that boot from a network disk image, there is nothing for you to worry about here.
I love how every time I read a “Critical” vulnerability in Linux it’s essentially “The user must leave their computer completely unlocked in an accessible area for a long period of time. Also he needs this very specific combination of programs running in these specific versions. Ah, and the planets have to be aligned for it to work. If all of these happen, an attacker might glimpse at your desktop wallpaper, so definitely critical”.
My first reaction would be to acknowledge them as a fellow geek, but that’s because most of the people who live near me would hurt themselves trying to open Notepad. Anyone who knows enough to start hacking my config files would be a welcome guest in my house.
It’s the last sentence of the article - 9.8/10. In this case it’s probably called critical because of the potential consequences of the exploit being a full machine takeover, not the likeliness of the exploit being used.
It means that CVSS is calculated wrong. It can’t be so big because default configuration is not affected and attacker requires admin access to change it.
Would this affect systems booting to the refind bootloader without secure boot? Sorry for the ignorance just trying to figure out if I should be changing my system for this news.
Add comment