[flagged]
CVE-2026-31431: Copy Fail vs. rootless containers
11–20 of 140 posts
Re: CVE-2026-31431: Copy Fail vs. rootless containers
#12Please post a tl;dr at the top or even in the subject. Many of us are scrambling to patch/reboot our **.
It already has a table of contents. The heading titled "why rootless containers stopped the escalation" is your tl;dr.
Re: CVE-2026-31431: Copy Fail vs. rootless containers
#13Sigh. 1. I would hope the default seccomp policy blocks AF_ALG in these containers. I bet it doesn’t. Oh well. 2. The write-to-RO-page-cache primitive STILL WORKED! It’s just that the particular exploit used had no meaningful effect in the already-root-in-a-container context. If you think you are safe, you’re probably wrong. All you need to make a new exploit is an fd representing something that you aren’t supposed t…
In fact, the authors specifically say on the very first line of their website that the copy/fail primitive can be used as a container escape. The entire premise of this article is flawed and irresponsible.
Re: CVE-2026-31431: Copy Fail vs. rootless containers
#14[flagged]
[deleted]
Re: CVE-2026-31431: Copy Fail vs. rootless containers
#15> [...] that root was just my unprivileged podman user on the host
Couldn't you then simply re-run the exploit again as unprivileged podman user and gain root on the host?
Re: CVE-2026-31431: Copy Fail vs. rootless containers
#16[flagged]
Re: CVE-2026-31431: Copy Fail vs. rootless containers
#17[flagged]
Re: CVE-2026-31431: Copy Fail vs. rootless containers
#18Sigh. 1. I would hope the default seccomp policy blocks AF_ALG in these containers. I bet it doesn’t. Oh well. 2. The write-to-RO-page-cache primitive STILL WORKED! It’s just that the particular exploit used had no meaningful effect in the already-root-in-a-container context. If you think you are safe, you’re probably wrong. All you need to make a new exploit is an fd representing something that you aren’t supposed t…
In fact, the authors specifically say on the very first line of their website that the copy/fail primitive can be used as a container escape. The entire premise of this article is flawed and irresponsible.
[deleted]
Re: CVE-2026-31431: Copy Fail vs. rootless containers
#19[flagged]
> (like reading env vars and sending them to an external server) it'd not be able to send credentials or fetch a malware remotely at all due to the DNS queries being intercepted by eBPF and being sent to a CoreDNS proxy.
Wouldn’t the exploit then just use ip addresses directly?
Re: CVE-2026-31431: Copy Fail vs. rootless containers
#20[flagged]
Please reply instead of (or in addition to) tagging the user you're replying to.