news
OpenSUSE: Slop Peddling and Polkit Authentication Bypass
-
OpenSUSE ☛ openSUSE Expands AI Support with Intel NPU Driver 1.35.0 and OpenVINO 2026.3.1 [Ed: Slop promotion for a bubble's sake]
As an Intel Innovator and a member of the openSUSE Innovator initiative, I remain committed to bringing the openSUSE ecosystem closer to the latest technologies in Artificial Intelligence and heterogeneous computing.
-
LACT: Polkit Authentication Bypass and Temporary File Handling Issues
LACT is a daemon and graphical user interface for controlling GPU devices on Linux. Beyond providing access to device information, features like GPU overclocking and cooler control are included. In a recent update of LACT a Polkit policy appeared, which triggered a review for the corresponding package in openSUSE Tumbleweed.
During the review we identified a Polkit authentication bypass and a predictable temporary file name issue, resulting in potential local root exploits. The following sections describe the security issues in detail. This report is based on release v0.10.0 of LACT.