SOLVED CVE-2021-4034 (PwnKit) Concern.

[Kasazn]

Hi lads,

Have you guys seen this bulletin recently? This is quite concerning.

https://www.bleepingcomputer.com/ne...s-root-on-all-major-distros-exploit-released/

 

[Arwen]

Actually it's not concerning at all, if I understand the issue correctly.

In order to use the exploit, you have to be local to the server. In the case of a NAS, normal users would not have login access, only administrators should have access. And admins should already have "root" access. So in this one case, that specific exploit is a non-starter for TrueNAS SCALE.

Edit: I don't mean to imply that it should not be fixed...

 

[Kris Moore]

@Arwen is correct. This is not a remote exploit, requires user to already have access to the NAS, so much lower priority for us at this time. That said, we'll include fixes for it here soon.

 

[Kasazn]

OK glad to know from knowledgeable people here! Thanks for the information. :)