Canonical/Ubuntu have been under DDoS

Post by eggprices » Fri, May 01, 2026, 4:35 PM UTC

bjackman wrote: post #34

mustardo wrote: post #15

Earlier quoted context omitted.

I thought copy.fail is a privelage escalation exploit, become root from a regular user? Am I missing something? How would "node architecture" make people vulnerable to this? You have to have shell access to a victim first right? Or am I missing something?

Yeah you need native code execution, and if you have AF_ALG access there is clearly no sandboxing in place. At that point it's game over on Linux, there are too many bugs. Even if you fix all the known ones in the current kernel, by the time the version with those fixes is qualified and released (not to mention, the machine must reboot), new LPEs have been discovered.

Post by eddythompson80 » Fri, May 01, 2026, 6:23 PM UTC

bjackman wrote: post #33

loufe wrote: post #17

Earlier quoted context omitted.

In what way is it "not a special bug"? It's a publicly known root access from RCE exploit. Those cannot be a dime a dozen. I'm sure it's especially interesting for any shared hosting services which might be affected, and could be delayed. I could find any places running containered services and exfiltrate secrets parallel services, no? What constitutes "special" for you, out of curiosity? Something chaining with a hy…

It's not RCE it's an LPE in an obscure corner of the kernel attack surface that no sensible application depends on. They are absolutely a dime a dozen. Even just in AF_ALG there have been several such vulns fixed in 2026 already. Kernel wide probably hundreds. It's true that most of them will be harder to exploit than this one but that just means you need to prompt your AI a bit harder to get an exploit. (To be fair,…

Post by IshKebab » Fri, May 01, 2026, 7:17 PM UTC

loufe wrote: post #17

bjackman wrote: post #14

Earlier quoted context omitted.

If you can access AF_ALG on a server you don't need to do shenanigans like that. It's much easier to just find another bug and exploit that one instead. The copy.fail website is very silly, it is not a special bug. If anyone gets compromised by that vuln their node architecture was broken anyway, patching copy.fail doesn't help.

In what way is it "not a special bug"? It's a publicly known root access from RCE exploit. Those cannot be a dime a dozen. I'm sure it's especially interesting for any shared hosting services which might be affected, and could be delayed. I could find any places running containered services and exfiltrate secrets parallel services, no? What constitutes "special" for you, out of curiosity? Something chaining with a hy…

Post by SilentM68 » Fri, May 01, 2026, 7:42 PM UTC

Post by esseph » Fri, May 01, 2026, 7:46 PM UTC

lproven wrote: post #19

esseph wrote: post #11

Earlier quoted context omitted.

Just move to flatpak, much nicer to deal with

In my testing I find the exact reverse. I much prefer snap to flatpak.