Fellow Linux admins -

As we move away from relying only on passwords to requiring a second factor for authentication, one-time passwords provide a great option. Linux admins generally use the OATH Toolkit, which provides components to build one-time password authentication systems.

However, we recently learned that even the second factor can't always be trusted when a SUSE researcher identified a vulnerability in the toolkit that could lead to escalated privileges on your system.

Read our full report to learn more about this vulnerability and how it might impact the systems you use.

You'll also learn about two severe Type Confusion bugs recently found in Chromium that could enable attackers to steal sensitive data and gain control over impacted systems.

If you found value in today’s newsletter, please share it with your friends! Do you have a Linux security-related topic you'd like to cover for our audience? We welcome contributions from passionate, insightful community members who share our love for Linux and security!

Stay safe out there,

Brittany Signature 150 Esm W150

Oath-Toolkit

The Discovery 

A critical vulnerability has been found in Oath-Toolkit - widely used for OTP authentication - that allows threat actors to escalate privileges on affected systems (CVE-2024-47191).

LinuxKernel Esm W206

The Impact

This bug could result in privilege escalation attacks and data loss.

The Fix

Essential Oath-Toolkit bug fixes have been released to mitigate this issue. We strongly recommend that all impacted users update  immediately to secure their sensitive data and critical Linux systems.

Your Related Advisories:

[distro_list_1]

Chromium

The Discovery 

Two severe Type Confusion bugs have been found in Chromium (CVE-2024-9602 and CVE-2024-9603).

Chromium Esm W225

The Impact

These vulnerabilities could enable attackers to steal sensitive data and gain control over impacted systems.

The Fix

Distros have released important Chromium security updates to mitigate these bugs. We urge you to apply these updates immediately to secure your sensitive information and protect your systems.

Your Related Advisories:

[distro_list_2]