alt Hacker NewsFormer tailscalar here and now someone managing tailscale at an org.
Having done my own review of the vulns and the fixes as they are landing in github, its pretty clear to me that this only affects situations where you use ACLs to permit ssh into a node (via tailscale ssh, not via opensshd), but dont give a path to sudoers/root.
If a user had no SSH access and/or connectivity to a vulnerable node, none of these vulns give them access.
However, if you have a vulnerable tailscaled and you give ssh access as some non-root account/privs, then yes, these vulns are relevant as theres now known privilege escalations that give access beyond some specific user account.
Not trying to play down the vuln (its important), but its not a free-for-all RCE that some ppl are acting like it is.
Replies
But a large portion of Tailscale users should be software engineering professionals, so a lot of the time, people use Tailscale just for SSH. I personally feel the impact is still quite big, especially since SSH leads directly to control of the server.
Why does your comment here contain more information than the blog post from tailscale itself?
I backup my different devices to my NAS. The user is a restricted backup user seeing only their own directory. I obviously don't want my torrent computer gets root on my NAS.
I personally use openssh, but someone else may use tailscale SSH.
I think this does downplay the vulnerability, since it assumes that teams using tailscale SSH have a lax security posture. I would hope that a security conscious team has accounts with least privilege available i.e. no root access. Please don't discount this critical vulnerability.
[flagged]
[dead]
Calling it “tailworm” feels like alarmism to promote their find more.
Would only show worm behavior if machines within the tailnet had the right settings and also were members of other tailnets with those settings but then it would require someone in that tailnet to have another tailnet with the right settings…
It’s far fetched.