Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Copy Fail

copy.fail

Post reply on HN
Print view View original

271–280 of 545 posts

Re: Copy Fail

#271

Post by q3k »

TZubiri wrote: post #266

It looks like this is legit, but the script is very phishy and I wouldn't run it in unvirtualized or disposable systems. https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/m... >zlib.decompress(d("78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3")) This is not source code, this i…

> This is not source code, this is binary, it's entirely possible that this contains a script that downloads another malicious script (or that simply contains the malicious commands)

It doesn't, it's just a compressed ELF file that does setuid(0); execve(/bin/sh, 0, 0). You can just unzlib it and throw it in a disassembler.

Re: Copy Fail

#272

Post by q3k »

marshray wrote: post #204
charcircuit wrote: post #28

SUID binaries once again assisted a local privilege escalation attack. This is a major problem that distros can't keep ignoring.

There's a claim upthread that a straightforward variation works against /etc/passwd.

You can also just use this to patch libc and turn close() into close-but-also-give-me-a-root-shell().

Re: Copy Fail

#273

Post by smaudet »

staticassertion wrote: post #246
hackernudes wrote: post #226

Earlier quoted context omitted.

I've read many CVEs (somehow that acronym is ok... heh) but have never seen LPE despite being familiar with the concept.

That seems literally borderline impossible.

You should re-evaluate your probabilities, I too have heard frequently of CVEs, but never of an LPE.

Re: Copy Fail

#274

Post by staticassertion »

smaudet wrote: post #273
staticassertion wrote: post #246

Earlier quoted context omitted.

That seems literally borderline impossible.

You should re-evaluate your probabilities, I too have heard frequently of CVEs, but never of an LPE.

I'm sure lots of people have heard of CVEs, but have you actually read many? LPE is an extremely common term. It's like not knowing RCE. These are the terms used.

Re: Copy Fail

#276

Post by buckle8017 »

still_grokking wrote: post #253
ebiggers wrote: post #232

As someone who works on the Linux kernel's cryptography code, the regularly occurring AF_ALG exploits are really frustrating. AF_ALG, which was added to the kernel many years ago without sufficient review, should not exist. It's very complex, and it exposes a massive attack surface to unprivileged userspace programs. And it's almost completely unnecessary, as userspace already has its own cryptography code to use. Th…

As I did not know what AF_ALG is in the first place I've searched for it and found this here: https://www.chronox.de/libkcapi/html/ch01s02.html It states the following: > There are several reasons for AF_ALG: > * The first and most important item is the access to hardware accelerators and hardware devices whose technical interface can only be accessed from the kernel mode / supervisor state of the processor. Such sup…

You should take note that this is written by the person that wrote the bad patch.

So grain of salt.

Re: Copy Fail

#277

Post by ebiggers »

sidewndr46 wrote: post #250
ebiggers wrote: post #232

As someone who works on the Linux kernel's cryptography code, the regularly occurring AF_ALG exploits are really frustrating. AF_ALG, which was added to the kernel many years ago without sufficient review, should not exist. It's very complex, and it exposes a massive attack surface to unprivileged userspace programs. And it's almost completely unnecessary, as userspace already has its own cryptography code to use. Th…

any idea what software this will break once I turn this kernel configuration off?

iwd is the main culprit (for systems that use it instead of wpa_supplicant).

I think cryptsetup / LUKS also requires it with some non-default options. With the default options, it works fine with the kconfigs disabled.

There's not much else, as far as I know. Normally programs just use a userspace library instead, such as OpenSSL.

Re: Copy Fail

#278

Post by 0x00cl »

IgorPartola wrote: post #198
Sohcahtoa82 wrote: post #187

Earlier quoted context omitted.

Resume-driven development

I would rather people who find this kind of stuff pad their resumes and get coolness points on HN than sell this exploit on the black market. But your priorities may be different and you might prefer they do the latter.

This is just a false dichotomy. Sure researches want money, credit but not at the cost of harming users or doing illegal things.

Re: Copy Fail

#279

Post by still_grokking »

buckle8017 wrote: post #276
still_grokking wrote: post #253

Earlier quoted context omitted.

As I did not know what AF_ALG is in the first place I've searched for it and found this here: https://www.chronox.de/libkcapi/html/ch01s02.html It states the following: > There are several reasons for AF_ALG: > * The first and most important item is the access to hardware accelerators and hardware devices whose technical interface can only be accessed from the kernel mode / supervisor state of the processor. Such sup…

You should take note that this is written by the person that wrote the bad patch. So grain of salt.

I've said I'm not sure about the validity of that reasoning.

I've liked it nevertheless for context, as augmentation to parent's post.

Re: Copy Fail

#280

Post by angry_octet »

x4132 wrote: post #237
angry_octet wrote: post #205

Earlier quoted context omitted.

These guys don't need to advertise, they are already 100% busy with work. But who wastes their time manually creating web pages? Especially kernel devs.

it's advertising their AI, not the talents of their humans :D

People are confusing the presentation layer with the content, just a surface layer analysis. Basically people are feeling so burnt by reading AI fluff that they make a rushed judgement.
Post reply on HN