Enterprise Linux Security Episode 17 - Polkit & LUKS CVE's

The New Year is just beginning, and we already have a few important CVE's to discuss, this time around Polkit and LUKS. The CVE numbers for these vulnerabilities are CVE-2021-4034 and CVE-2021-4122 respectively. In this episode, Jay and Joao discuss these vulnerabilities.

*🐧 Donate to Learn Linux TV and Receive a PDF with tips for switching to Linux*
Contains over 40 pages of tips and recommendations to help make your transition easier!

*🐧 Get an Awesome Linux Command Cheat Sheet*
For just $3, This brand-new PDF cheat sheet features all the commands you should know, as well as some of Jay's favorite aliases and tweaks!

*💧 Spin up some Linux Servers with Digital Ocean*
Digial Ocean is a great way to quickly spin up some Linux machines!

*🐧 Support Learn Linux TV*
_Note: Royalties and/or commission is earned from each of the above links_

## Relevant articles

LINUX BEGINNERS SHOULD WATCH THESE ESSENTIAL VIDEOS

CHECK OUT THESE LINUX COURSES TO LEVEL UP YOUR TUX POWERS

LISTEN TO A GEEKY PODCAST

WORK ON A FUN LINUX PROJECT

VISIT THESE OFFICIAL *🌐 LEARN LINUX TV ON THE WEB*

LEARN MORE ABOUT THE HOST

FAQ

Learn Linux TV provides technical content that will hopefully be helpful to you and teach you something new. However, this content is provided without any warranty (expressed or implied). Learn Linux TV is not responsible for any damages that may arise from any use of this content. The person viewing Learn Linux TV's content is expected to follow their best judgement and to make their best decisions while working with any related technology. Always make sure you have written permission before working with any infrastructure. Also, be sure that you're compliant with all company rules, change control procedures, and local laws.

#Linux #Enterprise #DevOps

[rudyleplane]

Always a priceless learning experience, even for a seasoned tech

[evertnuman]

The wonderful world of IT and IOT. As a retired seasoned sys/net/app tech and dev, any app that required elevated access was sent back to be reworked so that elevated access was not required. It was a protracted argument then, and these days I'm sure it's no different.

[f-s-r]

This reminds me of an article called "who pays to fix open souce bugs" (or something like that), which made a really good point: lots of corporations do use open source software, one way or another. It would be a really good idea for those corporations to contribute to the projects that they use, so that more programmers can search for and fix vulnerabilities, instead of just relying on software that was made by altruistic people on their own free time. Most of the Internet runs on open source, after all! If open source received all of the attention and investment it deserves, vulnerabilities would be detected much earlier, and even feature enhancements would be much more frequent.

[mikeerdely]

Regarding the LUKS CVE, "The decryption step is performed after a valid user activates the device with a correct passphrase and modified metadata." So it seems that the disk must already be unlocked in order to exploit the CVE.

[alexxx]

29:29 Can we start call it Log4J pandemic now? ;)

[alexxx]

Begs a question, how many vulnerabilities are still there that lie dormant, waiting to be exploited?

[jordondavidson]

CVE-2021-4122 Has a Reserved status (at time of comment) so there doesn't appear to be any information available. Where are you getting your info about the vulnerability?

[alexxx]

Yeah, maybe call this the "Security Digest" to not confuse it with other general thematic episodes?

[NekoiNemo]

I wonder if the LUKS vulnerability can be used to swap the password on the encrypted disk, giving the admin a nasty surprise at the next reboot

[nrakesh]

Without watch liked it seems trust on content

[babykosh]

So how do I patch this problem on my local linux system?