@[email protected] there’s no technical details at all, it’s just people panicking without knowing what they’re panicking about, which InfoSec peeps are very good at and usually ends poorly. There’s nothing actionable.
Regarding the "unspecified Linux vulnerability" that the author has been "hyping the shit out of" (their words) all week -
It's accidentally leaked, due to an unpaid open source maintainer making a boo boo.
It's in CUPS, a printing subsystem. It isn't Linux specific.
CUPS isn't faced much to the internet, I've checked and done a Shodan Safari. It also isn't installed by default on Linux server installs for almost all distros.
It's not a big deal, update packages are dropping, don't panic.
Pouring one out for the unpaid open source maintainers dealing with this stuff for the past few weeks.
I notice the finder tweeting about it (before the announcement window) has turned off the ability to reply to their tweets.
Re the “Linux RCE” story, I’d like to point the press breathlessly covering this to one minor (sarcasm) detail for exploitation: “A potential victim attempts to print from the malicious device”
My thoughts on how this has played out: https://www.linkedin.com/posts/kevin-beaumont-security_open-source-has-many-unpaid-volunteers-who-activity-7245168546840793088-3N7A?utm_source=share&utm_medium=member_ios
Also; all the press articles I’ve seen on this have taken the word of the vulnerability finder as gospel - they haven’t actually fact checked it.
Eg none of the CVEs are CVSS score 9.9. Or close.
The sole source in articles shouldn’t be a known bully. The story is probably more how this played out so it doesn’t happen again.
The media are going to have to go back and rewrite or delete the articles here.. it’s not labelled Critical, it’s not a 9.9 etc etc.
I think there’s probably lessons to be learned here around how vulns are covered.
Patches are out for the major distros, if you have Ubuntu desktop it should have auto updated already.
Hopefully nobody printed to the doomsday printer and got cyber mega(tm) owned in the cyber pandemic(tm) of 2024
When Strange and Mysterious printers Unexpectedly show up on your network, >>> Do NOT Print to them!!! <<< Their "drivers" may be malware!
@GossiTheDog It used to be that you had to study journalism in order to become one, it also used to be that newspapers cared about the facts and accuracy of their articles.
That metric is long gone, now you can be a „journalist“ by copy pasting hacker news , and the metric that defines a good journalist is who does it in a way that increases click counts and time staying on page…
I don’t expect anything from any news page anymore, my brain has hardwired an disclaimer to all of them that goes „nothing that we say comes with any fact check or implied liability, because we just echo social media“
looking at the "kill chain", and CUPS crashing 9 times/10 if you try the exploit, the right value could be 0.99, more or less.
@ljrk @hacks4pancakes @GossiTheDog You can now get printers that use ink in refillable tanks. They cost about $200 since the makers understand they will never sell you ink for more than the price of human blood, but are worth it. I will never buy another cartridge printer, ever.
If you can get one that can print from a camera card too, so much the better: no print support needed at all on your computers.
(UPDATE: turns out HP is also under boycott for doing business with Netanyahu's genocidal regime in Israel. Don't buy HP at all)
DO NOT BUY any HP printer that has HP+ enabled by default! This malware locks the printer to HP's own ink (printer DRM) and also blocks printing unless the printer is connected to the Internet and logged into an HP account.
If you get stuck with an HP+ printer, take it back for a refund. If they won't take it back, scrap it: there's no safe way to use it as HP+ once turned on can never be turned off.
I once asked a Wal-Mart to stop selling HP+ printers as they are malicious and few customers will ever known in advance that use requires an HP account and connecting the printer to the Internet.
@hacks4pancakes @GossiTheDog Didn't expect a long rant about printers either ^^'
I just find it ironic that the Linux printing joke isn't really accurate nowadays – but the reason for that is a) Apple and b) a protocol that is now associated with "the" Linux printer CVE :'-D
Side note: I personally mostly use a copy shop once in a while but, say, teachers often print their exercise sheets. And that's quite useful to print from an OS. And indeed, printing through IPP is definitely a breeze and I don't want to go back. It's not much more that a HTTP POST request with a PDF!
@GossiTheDog that "the user needs to print a document" does indeed make all the difference, stopping the from being completely automated to requiring user interaction.
Yes, you could add an evil printer with the same name as the real one (if you happen to know that name). There may be even some weird system with a cron sending job automatically to a printer. But all in all, printing is a (relatively) uncommon action (even on environments where it is popular), drastically lowering the impact.
However, I do wonder if that open port 631 couldn't be used to send a print job to that just-installed-evil-printer, dropping victim interaction altogether.
@GossiTheDog How not to hack a millenial:
Go ahead and hit us in the:
Printer
Car
House
401K
We will just laugh as you punch at imaginary objects.
Kevin Beaumont
knapjack
Michael Weiss
Fritz Adalis
Alex
Jeff Grigg
Fellows
defnull
Marcus Adams
gary
arcayr
Lesley Carhart 
aburka 🫣
xsk
Tom DB 🦣
VessOnSecurity
Leonardo Lanzi
kampfschwaetzer
Gilgwath
sortius
Mihai
Dragon
lena
uwuhaeckse
lj·rk
LukefromDC
nobletrout
Steve
Stephen Wuebker
Jima 
Alan Miller 
🇺🇦
pootriarch
David Anson
Scott 
Ludwig Vielfrass
Frank Küsel
Lord Kusuriya 
crlf
standev
Noah Cook
Ceri 
pmelon