Copy Fail • Hacker News Board

Re: Copy Fail

#41

Post by eddythompson80 » Wed, Apr 29, 2026, 7:06 PM UTC

Lorin wrote: post #3

What is the rationale behind naming CVEs and individual domains? Marketing?

Giving catchy names for bad exploits has been a thing for a while. Probably to make sure it's easy to reference and make sure you're patches as opposed to passing numbers around. Heartbleed, Shellshock, BEAST, Goto Fail, etc

Re: Copy Fail

#42

Post by [deleted] » Wed, Apr 29, 2026, 7:09 PM UTC

rdtsc wrote: post #39

jzb wrote: post #24

This is amazing. Page says it works on RHEL 14.3, which doesn’t exist. Current RHEL is 10.x, this must’ve been done in a TARDIS.

[flagged]

[deleted]

Re: Copy Fail

#43

Post by int0x29 » Wed, Apr 29, 2026, 7:10 PM UTC

zb3 wrote: post #29

rany_ wrote: post #21

Could this be used to root Android devices? Does Android ship with algif_aead?

Android is smarter than setuid + system partitions aren't writable.

Its not writing to the partition though is it? It is polluting the cache page via a write with a buffer overrun in the kernel. I don't think buffer overruns follow permissions.

Re: Copy Fail

#44

Post by tptacek » Wed, Apr 29, 2026, 7:10 PM UTC

rdtsc wrote: post #39

jzb wrote: post #24

This is amazing. Page says it works on RHEL 14.3, which doesn’t exist. Current RHEL is 10.x, this must’ve been done in a TARDIS.

[flagged]

I have no idea about this page, but Theori/Xint has a staff of veterans, they are a serious thing.

Re: Copy Fail

#45

Post by stackghost » Wed, Apr 29, 2026, 7:11 PM UTC

maxtaco wrote: post #27

Use extreme caution running arbitrary code on your machines, especially obfuscated code that tickles kernel bugs! (edited)

Analysis of the POC concurs with my tests that confirm that the portion of `su` that gets overwritten does not survive a reboot.

Re: Copy Fail

#46

Post by chasil » Wed, Apr 29, 2026, 7:11 PM UTC

On the downside, I need to push new kernels to all my servers.

On this bright side, does this mean Magisk is coming to all unpatched Android phones?

Re: Copy Fail

#47

Post by Tuna-Fish » Wed, Apr 29, 2026, 7:12 PM UTC

corvad wrote: post #10

If this is verified, this is a very big deal. Root access on any shared computer. Additionally do we know what kernel versions and stable versions have the patch?

I just tested on my home server running ubuntu 24.04 LTS with newest kernel from repositories, got root.

Re: Copy Fail

#48

Post by rdtsc » Wed, Apr 29, 2026, 7:13 PM UTC

tptacek wrote: post #44

rdtsc wrote: post #39

Earlier quoted context omitted.

[flagged]

I have no idea about this page, but Theori/Xint has a staff of veterans, they are a serious thing.

The fact that they have no idea RHEL 14, probably the most well known enterprise distro, is not a thing, and yet they "directly verified on it" casts some doubt on seriousness.

Re: Copy Fail

#49

Post by tptacek » Wed, Apr 29, 2026, 7:14 PM UTC

Lorin wrote: post #3

What is the rationale behind naming CVEs and individual domains? Marketing?

It's certainly marketing, but it's prosocial: there's no scarcity of names, and "copy.fail" is much easier to remember and talk about than "CVE-2026-31431".

Re: Copy Fail

#50

Post by notpushkin » Wed, Apr 29, 2026, 7:14 PM UTC

rany_ wrote: post #21

Could this be used to root Android devices? Does Android ship with algif_aead?

I’ve poked around on my phone and it didn’t work:

    File "/data/data/com.termux/files/home/a.py", line 5, in c
      a=s.socket(38,5,0); # ...
    File "/data/data/com.termux/files/usr/lib/python3.13/socket.py", line 233, in __init__
      _socket.socket.__init__(self, family, type, proto, fileno)
      ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  PermissionError: [Errno 13] Permission denied