For most this shouldn't be a drama, but please if you have external SSH available, make sure your passwords are secure. As for the moment any account will allow root access to our boxen with this exploit.

http://www.securityfocus.com/bid/27704/info

I can confirm it works

leon@mythbox:~$ ./Exploit1
-----------------------------------
Linux vmsplice Local Root Exploit
By qaaz
-----------------------------------
[+] mmap: 0x0 .. 0x1000
[+] page: 0x0
[+] page: 0x20
[+] mmap: 0x4000 .. 0x5000
[+] page: 0x4000
[+] page: 0x4020
[+] mmap: 0x1000 .. 0x2000
[+] page: 0x1000
[+] mmap: 0xb7da7000 .. 0xb7dd9000
[+] root
root@mythbox:~# whoami
root

Fixed in later kernels.

_________________
DRM 'manages access' in the same way that jail 'manages freedom.'
_________________
Intel P4 2.6
Intel Desktop Board
2GB DDR400
nVidia 6600GT
Dvico HDTV+
Dvico Dual 4
200GB WD for Swap /boot & /
2x 500GB WD with LVM & XFS for /myth/tv

Good find! The next release will have 2.6.22 or later, which should have the patch.

_________________
KnoppMyth R5.5
MythiC Dragon v2.0
Join the KnoppMyth Frappr!

Currently a handy way to get root without a password

_________________
DRM 'manages access' in the same way that jail 'manages freedom.'
_________________
Intel P4 2.6
Intel Desktop Board
2GB DDR400
nVidia 6600GT
Dvico HDTV+
Dvico Dual 4
200GB WD for Swap /boot & /
2x 500GB WD with LVM & XFS for /myth/tv