Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Copy Fail

copy.fail

Post reply on HN
Print view View original

21–30 of 545 posts

Re: Copy Fail

#22

Post by barbegal »

skilled wrote: post #9

This looks like an extraordinary find at first glance. Does this mean you can go from a basic web shell from a shared hosting account to root? I can see how that could wreak havoc really quickly.

Yes I would imagine lots of those type of services would be vulnerable if they hadn't updated to the latest kernel versions.

Re: Copy Fail

#23

Post by stackghost »

barbegal wrote: post #22
skilled wrote: post #9

This looks like an extraordinary find at first glance. Does this mean you can go from a basic web shell from a shared hosting account to root? I can see how that could wreak havoc really quickly.

Yes I would imagine lots of those type of services would be vulnerable if they hadn't updated to the latest kernel versions.

As of this comment, Debian Stable ("Trixie", though I hate codenames) doesn't have a fix in place and remains vulnerable, or at least their CVE tracker shows it as such:

https://security-tracker.debian.org/tracker/CVE-2026-31431

Re: Copy Fail

#24

Post by jzb »

This is amazing. Page says it works on RHEL 14.3, which doesn’t exist. Current RHEL is 10.x, this must’ve been done in a TARDIS.

Re: Copy Fail

#25

Post by kro »

embedding-shape wrote: post #15

For mitigation, the page currently basically just says: > Update your distribution's kernel package to one that includes mainline commit a664bf3d603d But it isn't very clear to me what Kernel version you can expect that to be in. For Arch/CachyOS, the patch seems to be included in 6.18.22+, 6.19.12+ and 7.0+. If you're on any of the lower versions in the same upstream stable series, you're likely vulnerable right now…

Major os vendors will publish pages with the fixed versions:

https://security-tracker.debian.org/tracker/CVE-2026-31431

https://ubuntu.com/security/CVE-2026-31431

Also, disabling algif_aead is suggested as mitigation

Re: Copy Fail

#26

Post by themafia »

> If your kernel was built between 2017 and the patch

This is why I compile my own kernel. I disable things I don't use. If it's not present it can't hurt you.

> block AF_ALG socket creation via seccomp regardless of patch state.

Likewise I use seccomp to only allow syscalls that are necessary. Everything else is disabled. In the programs I have that need to connect to a backend socket, that is done, and then socket creation is disabled.

Re: Copy Fail

#27

Post by maxtaco »

Use extreme caution running arbitrary code on your machines, especially obfuscated code that tickles kernel bugs! (edited)

Re: Copy Fail

#29

Post by zb3 »

rany_ wrote: post #21

Could this be used to root Android devices? Does Android ship with algif_aead?

Android is smarter than setuid + system partitions aren't writable.
Post reply on HN