Saint Holey Beep, the Hole That Beeps

Patron of tiny programs with the setuid bit, parody sites with logos, and terminals that go beep.

Life

On 3 April 2018 the world learned that even beep, the command that makes the computer go beep, had a hole: in versions up to 1.3.4, when installed setuid as on Debian, a race condition let a local user become root. The site holeybeep.ninja celebrated it with a Heartbleed-style name and logo, in full parody. And by most accounts even the site's own "patch" hid a prank abusing a flaw in GNU patch.

Prayer

O Saint Holey Beep, who makes root ring with a simple beep, keep our smallest programs humble and free of setuid. Amen.

How to celebrate

Celebrated by updating the beep package, removing its setuid bit, and reading patches before applying them.

Even the smallest beep can wake root.