Post by @lproven@social.vivaldi.net

Terminal2Shell (CVE ID pending · also tracked as "TermGeddon")

A critical flaw present in every operating system since 1971 allows anyone who opens a terminal to obtain a fully interactive shell. Instantly. With no authentication beyond the one they already did.

Terminal2Shell

Terminal2Shell: Critical flaw grants instant shell access on every major OS

Researchers disclose a 55-year-old vulnerability affecting macOS, Windows and Linux. Exploitation is trivial and requires no special tools. No patch exists.

1 Boost

0 Likes

David Gerard

@davidgerard@circumstances.run 6 min. ago

@lproven if they say they found it with AI, the CVE number is assured

Paweł Piątkowski

@cosi@mastodon.sdf.org 1 hr. ago

@lproven Another bad news: similar flaw exists in Emacs: when you run `eshell`, you get FULL ACCESS to the shell, including root access (if you're a sudoer)! All Emacs versions are affected.

EDIT: CVSS score from 10.0 to 11.0 (on machines that go up to eleven).

Douglas Spencer

@dougs@masto.nd2.uk 53 min. ago

@cosi @lproven
You can find out whether your machine goes up to ten or eleven by employing A/B testing (in hex).