A "disaster" vulnerability was exposed in the Linux circle: it has existed for more than 10 years and affects almost all distributions

On September 27, a serious remote code execution (RCE) vulnerability was exposed in the Linux circle. It has existed for more than 10 years and affects almost all GNU/Linux distributions. There is currently no patch to fix it, but it can be mitigated.

Software developer Simone Margaritelli first disclosed these RCE vulnerabilities in a tweet on the X platform on September 23. The relevant development teams have been notified and will be fully disclosed in the next two weeks.

Vulnerability damage

Margaritelli said that these vulnerabilities do not currently have CVE tracking numbers assigned, but there will be at least 3, and ideally 6.

Canonical (Ubuntu developer), Red Hat, and other distribution development teams and companies have confirmed the severity of these RCE vulnerabilities, with an estimated CVSS score of 9.9 (out of 10, with higher scores representing more dangerous), which indicates that if exploited, it could cause catastrophic damage.

Vulnerability Details

The vulnerability mainly exists in the Unix printing system CUPS. If the user is running CUPS and has enabled cups-browsed, there is a risk of being attacked, causing the user's device to be remotely hijacked.

However, the CUPS development team was divided on how to deal with the vulnerability, with some members arguing about the security impact of the vulnerability on actual operations, which Margaritelli expressed frustration with.

The researchers note that despite providing multiple proofs of concepts (PoCs) that systematically disproven developers’ assumptions, progress remains slow.

Mitigation

IT Home quoted Margaritelli as saying that there is currently no patch, and users can try the following mitigation solutions:

• Disable or remove cups-browsed service

• Update your CUPS installation to pull in security updates as they become available.

• Block access to UDP port 631 and consider turning off DNS-SD.

• If port 631 is not directly accessible, an attacker may be able to exploit it by spoofing zeroconf, mDNS, or DNS-SD advertisements.