Post B5rU3peqh7TOUTACVE by brib@bribstodon.xyz
(DIR) More posts by brib@bribstodon.xyz
(DIR) Post #B5p3fd24ztYdG8uLg0 by pndc@social.treehouse.systems
0 likes, 0 repeats
It's been all downhill since the Underwood Model One.#copyfail
(DIR) Post #B5p3fdO3gB8eMJBtw0 by pndc@social.treehouse.systems
1 likes, 3 repeats
Although I also note that #copyfail requires a specific exploitable kernel module to be loaded, and it's not loaded by default (or on-demand) on at least my Debian boxes. So the claim that "the same 732-byte Python script roots every Linux distribution shipped since 2017" does turn out to be the usual factually-incorrect overhyped exaggeration we get from infosec people every time they want to scare people to drum up more business.
(DIR) Post #B5p3fhbfzUPNRhapiS by pndc@social.treehouse.systems
0 likes, 0 repeats
I have now read the technical description of this exploitable kernel bug. The root cause, as you've probably already guessed, is that something was handed a copy-on-write buffer, only did a partial copy, failed to update the pointer, and ultimately mutated the source buffer, because most of Linux is implemented in dangerously-unsafe C (not like there's any other kind of C) and neither the compiler nor the documentation flagged up that such mutation of a buffer it didn't own was verboten.It's a cheap shot and a cliche to say as much, but is the exact class of errors which Rust was designed to solve. No need for resource-intensive AI-powered scanners or expensive consultants. It's detected statically at compile time.(Yes, I know about unsafe, I don't need to hear the whataboutery from C bros.)
(DIR) Post #B5pRidFr1dzjiWJeJU by Tubemeister@mstdn.social
0 likes, 0 repeats
@pndc Have you tested the actual thing though? On mine the module wasn't loaded either but I got root just like that anyway, on an up to date ubuntu 24.04.This one is a right bastard, one-shot root on at least most common linux distros is good enough to give it some hype.
(DIR) Post #B5pRidYzsTJ6ftGw9Q by pndc@social.treehouse.systems
0 likes, 0 repeats
@Tubemeister Yes, I did test it. It shat itself because it couldn't open an AF_ALG socket because the kernel module wasn't loaded, and wasn't configured to be demand-loaded when opening that socket type.
(DIR) Post #B5pRidm75hnbKZPPay by brib@bribstodon.xyz
0 likes, 0 repeats
@pndc @Tubemeister Which distro do you run?
(DIR) Post #B5pRie2m5l7uAFCiZ6 by pndc@social.treehouse.systems
0 likes, 0 repeats
@brib @Tubemeister I already said. Debian. The random box I picked to test it on hadn't even been hardened beyond nuking the preinstalled malware systemd.
(DIR) Post #B5pRieSeXXpJSVJNtw by malte@anticapitalist.party
0 likes, 0 repeats
@pndc @brib @Tubemeister i tested on a few debian vms, and it seems to depend on how the host system starts them, because there are for sure stock and up to date debians the exploit works without trouble on 😥
(DIR) Post #B5pRiek1UximKNRFya by lanodan@queer.hacktivis.me
0 likes, 0 repeats
@malte @pndc @brib @Tubemeister Well it doesn't seems fixed on all Debians?https://security-tracker.debian.org/tracker/CVE-2026-31431
(DIR) Post #B5rU3pMPnejBZIXTlo by TheOneDoc@tech.lgbt
0 likes, 0 repeats
@lanodan @malte @brib @Tubemeister @pndc it's also not in trixie backports yet
(DIR) Post #B5rU3peqh7TOUTACVE by brib@bribstodon.xyz
0 likes, 0 repeats
@TheOneDoc @lanodan @malte @Tubemeister @pndcYeah I decided to disable the module in all the servers I run
(DIR) Post #B5rU3ppq2GGP2YIydE by TheOneDoc@tech.lgbt
1 likes, 0 repeats
@brib @lanodan @malte @Tubemeister @pndc as it would need a RCE fist and all public facing services are proxied via a BSD machine. I'm not bothered.Remember to never trust your security to a mono culture ans run each service/machine as secure and lean as possible.The only person with local login (via LAN only) on any of 'em is me so that's also not a problem.