"Dirty Pipe" Linux vulnerability

[Etorix]

A critical vulnerability has been found in Linux kernels from 5.8 to 5.16.11/5.15.25/5.10.102.

Linux has been bitten by its most high-severity vulnerability in years

Dirty Pipe has the potential to smudge people using Linux and Linux derivitives.

arstechnica.com

As of TrueNAS SCALE 2.02.2, the console reports "5.10.93+truenas", so I guess SCALE is an affected "Linux derivative". Correct?

 

[Kris Moore]

Yes, we'll be looking at scheduling a fix here in the near future. However this exploit does require the user already have local shell access, not a remote exploit that I can see. So be sure to secure your SSH sessions to only trusted users in the meantime.

 

[elvisimprsntr]

Latest nightly is running newer kernel.

TrueNAS-SCALE-22.12-MASTER-20220310-132924

Code:

root@NAS-3[~]# uname -a
Linux NAS-3 5.10.103+truenas #1 SMP Tue Mar 8 20:31:49 UTC 2022 x86_64 GNU/Linux