Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Copy Fail

copy.fail

Post reply on HN
Print view View original

81–90 of 545 posts

Re: Copy Fail

#81

Post by oskarkk »

1p09gj20g8h wrote: post #76
kro wrote: post #25

Earlier quoted context omitted.

Major os vendors will publish pages with the fixed versions: https://security-tracker.debian.org/tracker/CVE-2026-31431 https://ubuntu.com/security/CVE-2026-31431 Also, disabling algif_aead is suggested as mitigation

Where are you seeing the disabling algif_aead mitigation?

In TFA: https://copy.fail/#mitigation

> Before you can patch: disable the algif_aead module.

> echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf

> rmmod algif_aead 2>/dev/null || true

Edit: and I can confirm that on my system with kernel 6.19.8 the above fixes the exploit.

Re: Copy Fail

#82

Post by xeeeeeeeeeeenu »

It seems there was some kind of confusion during the disclosure process, because the vendors aren't treating this vulnerability as serious and it remains unpatched in many distros.

https://access.redhat.com/security/cve/cve-2026-31431 "Moderate severity", "Fix deferred"

https://security-tracker.debian.org/tracker/CVE-2026-31431

https://ubuntu.com/security/CVE-2026-31431

https://www.suse.com/security/cve/CVE-2026-31431.html

Re: Copy Fail

#83

Post by akerl_ »

john_strinlai wrote: post #74
QuantumNomad_ wrote: post #69

Earlier quoted context omitted.

> CVEs are, for whatever reason, like the only thing on the planet that people seem to have a problem with when they receive a name. i am not sure why. What, you guys talk about books based on their “title” instead of just memorising the ISBN of each book? Pssh, count me disappointed!

after work i have to stop at Y87794H0US1R65VBXU25 for some groceries.

I only refer to my kids by their social security numbers until they do something suitably remarkable.

I guess it’s a good thing I’m not a SovCit or I’d just have to call them Traveller Three and Traveller Four

Re: Copy Fail

#85

Post by ok123456 »

smlacy wrote: post #75

The fetishism of "byte count" (here, as "732 byte python script") needs to stop, especially when in a context like this where they're trying to illustrate a real failure modality. Looking at their source code [1] it starts with this simple line: import os as g,zlib,socket as s And already I'm perplexed. "os as g"? but we're not aliasing "zlib as z"? Clearly this is auto-generated by some kind of minimizer? Likely bec…

This is pretty legible compared to the 90s C rootshell.org exploits.

Re: Copy Fail

#86

Post by dist-epoch »

> Will you release the full PoC?

> Yes — it's on this page. We held it for a month while distros prepared patches; the major builds are out as of this writing.

There is no update available for Ubuntu 24, PoC works and just tried updating.

Re: Copy Fail

#87

Post by Avamander »

Tuna-Fish wrote: post #47
corvad wrote: post #10

If this is verified, this is a very big deal. Root access on any shared computer. Additionally do we know what kernel versions and stable versions have the patch?

I just tested on my home server running ubuntu 24.04 LTS with newest kernel from repositories, got root.

Can Livepatch mitigate this or is it already? I don't know where to look this up.

Re: Copy Fail

#88

Post by Tuna-Fish »

xeeeeeeeeeeenu wrote: post #82

It seems there was some kind of confusion during the disclosure process, because the vendors aren't treating this vulnerability as serious and it remains unpatched in many distros. https://access.redhat.com/security/cve/cve-2026-31431 "Moderate severity", "Fix deferred" https://security-tracker.debian.org/tracker/CVE-2026-31431 https://ubuntu.com/security/CVE-2026-31431 https://www.suse.com/security/cve/CVE-2026-3143…

Yeah, by ubuntu's own guidelines linked on that page, this should be priority: high, but instead it's marked as medium.

Re: Copy Fail

#89

Post by MarleTangible »

xeeeeeeeeeeenu wrote: post #82

It seems there was some kind of confusion during the disclosure process, because the vendors aren't treating this vulnerability as serious and it remains unpatched in many distros. https://access.redhat.com/security/cve/cve-2026-31431 "Moderate severity", "Fix deferred" https://security-tracker.debian.org/tracker/CVE-2026-31431 https://ubuntu.com/security/CVE-2026-31431 https://www.suse.com/security/cve/CVE-2026-3143…

Seems like distros consider it a medium risk because it doesn't involve remote code execution and requires local access. Though it allows local root privilege escalation which is considered high priority.

https://ubuntu.com/security/cves/about#priority

> Medium: A significant problem, typically exploitable for many users. Includes network daemon denial of service, cross-site scripting, and gaining user privileges.

Re: Copy Fail

#90

Post by debo_ »

smlacy wrote: post #75

The fetishism of "byte count" (here, as "732 byte python script") needs to stop, especially when in a context like this where they're trying to illustrate a real failure modality. Looking at their source code [1] it starts with this simple line: import os as g,zlib,socket as s And already I'm perplexed. "os as g"? but we're not aliasing "zlib as z"? Clearly this is auto-generated by some kind of minimizer? Likely bec…

I don't see it as fetishizing byte count. I think of it as a proxy measure for how complicated or uncomplicated the exploit might be. They could just as well have said "we can do it in 3 lines of python" or "the Shannon entropy of the script implementing the exploit is really small" and I would have interpreted it similarly.

Where do you see this "fetishizing" happening most often? It's a strange thing to counter-fetishize about.

Post reply on HN