Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Copy Fail

copy.fail

Post reply on HN
Print view View original

531–540 of 545 posts

Re: Copy Fail

#531

Post by [deleted] »

PunchyHamster wrote: post #530
buredoranna wrote: post #286

Earlier quoted context omitted.

Please don't rely on my judgement for this being safe for production, but after blacklisting the modules, the provided python exploit failed. Check if the following are modules grep CONFIG_CRYPTO_USER_API /boot/config-$(uname -r) If they are, you can try blacklisting them /etc/modprobe.d/blacklist-crypto-user-api.conf """ blacklist af_alg blacklist algif_hash blacklist algif_skcipher blacklist algif_rng blacklist alg…

over 500 servers with very varied workload i manage didn't had this module loaded so my guess is "near zero" also only algif_aead is vulnerable

[deleted]

Re: Copy Fail

#532

Post by marshray »

x4132 wrote: post #249
marshray wrote: post #125

Earlier quoted context omitted.

The lesson here being... compile your own kernel from git sources every few days? Give up entirely on non-virtualized container security? This is not sarcasm. I'd finally given in and started learning about docker/podman-style OCI containerization last week.

are you sure containerization would be more secure? this is also a rootless podman escape. the lesson here is to not give random people shell access to your systems.

No, I meant that I'd resisted doing anything with Docker for its entire existence and just finally gave in and started messing with podman.

I have amazing timing.

Re: Copy Fail

#535

Post by a96 »

SoftTalker wrote: post #487
a96 wrote: post #399

Earlier quoted context omitted.

I would absolutely expect a sysadmin in particular to know and understand the term and acronym.

It's still just courteous to define acronyms on first use, it doesn't take any real effort to do that.

Very much true, and I would never criticize that. Just that this term would be particularly obscure to a sysadmin which seems completely backwards.

Re: Copy Fail

#537

Post by alexdevphp »

dsr_ wrote: post #420
globular-toast wrote: post #350

Earlier quoted context omitted.

Is it built as a module in most distros?

It is built as a module in Debian. lsmod shows it is not loaded on any of the Trixie or Bookworm machines I have checked, Intel or AMD.

As I understands any program code can use that socket to write to page cache memory and modify any main program. Even php code can be written for that. So it is serious problem if there is other security hole on web server.

Re: Copy Fail

#538

Post by TommyTran732 »

kuhsaft wrote: post #481
fsflover wrote: post #456

Earlier quoted context omitted.

> Dom0 (the admin Qube) is running the Linux kernel and is vulnerable Yes, it is vulnerable, except there is no attack vector, as you don't run any software there: https://doc.qubes-os.org/en/r4.3/user/downloading-installing... > DomU (App Qubes) also run the Linux kernel and are just as vulnerable. I think you misinterpret the Qubes approach to security. If you do everything in one VM, you get no protection from the…

So, not being vulnerable is dependent on not doing something that can make you vulnerable? That doesn't seem right. If you can do something to make yourself vulnerable, you are vulnerable. > https://www.qubes-os.org/news/2026/04/28/xsas-released-on-20... Looking at just that small list, they mark some vulnerabilities as not vulnerable because it's "In-VM attack only". That's disingenuous. > There is no way to use the…

To be completely fair, any kind of sandboxing inside of Qubes's VMs do not mean much, because it is on X11. Any app can pwn any other app lol.

With that being said, yeah, he's being disingenuous as per usual for sure. Part of Qubes hardening is trying to not allowing an attacker to gain root to make it harder to attack Xen, but our evangelist here claims it doesn't matter if an attacker has root :)

Re: Copy Fail

#539

Post by angry_octet »

eqvinox wrote: post #507
angry_octet wrote: post #409

Earlier quoted context omitted.

I'm also wondering if it couldn't be rewritten to use io_uring interfaces.

That's really orthogonal (and you can already do io_uring with AF_ALG, at the end of the day AF_ALG is just recvmsg() and sendmsg(), which work just fine in io_uring...)

I mean for more efficient and easier to verify out-of-kernel implementations of crypto with kernel like speeds.

Re: Copy Fail

#540

Post by Orygin »

eddythompson80 wrote: post #469
Orygin wrote: post #403

Earlier quoted context omitted.

Considering they kinda botched the disclosure to Linux distros, I guess they wanted something most sensational to sell more licenses.

How did they botch the disclosure to distros?

They did not make a disclosure to the distros
Post reply on HN