Tag

Copy Fail

All articles tagged with #copy fail

security3 months ago•3 min saved

Linux Copy Fail flaw exploited to gain root across major distros, CISA warns

CISA warns that the Copy Fail vulnerability (CVE-2026-31431) in the Linux kernel’s algif_aead interface is being exploited to obtain root privileges on unpatched systems, with a PoC shown for Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16. Patches are rolling out across major distros; CISA added the flaw to the Known Exploited Vulnerabilities catalog and urges prompt patching per vendor guidance under BOD 22-01, following earlier patches like Pack2TheRoot.

via BleepingComputer|

#cisa #copy-fail #cve-2026-31431

tech3 months ago•53 min saved

Copy Fail: Linux flaw lets any user grab root, patches rolling out

A widespread Linux vulnerability called Copy Fail (CVE-2026-31431) lets any user escalate to administrator privileges across most distributions since 2017. The exploit uses a cross-distro Python script with no per-distro offsets or recompilation, and can evade detection due to page-cache corruption that hides modified bytes from common monitoring tools. Theori researchers, with help from the Xint Code AI tool, disclosed the flaw; a patch was added to the mainline Linux kernel on April 1, and some distributions (e.g., Arch Linux, Red Hat Fedora, Amazon Linux) have since released patches or mitigations, though many others remain unpatched.

via The Verge|

#copy-fail #cve-2026-31431 #linux

cybersecurity3 months ago•58 min saved

Copy Fail: Linux Kernel Zero-Day That Grants Root Across Distros

Security researchers disclosed Copy Fail, a Linux kernel zero-day (CVE-2026-31431) that lets any unprivileged local user gain root on major distros since 2017 by abusing AF_ALG sockets and splice() to corrupt in-memory page cache, leaving on-disk files unchanged; a 732-byte Python exploit reliably achieves root on tested systems (Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL, SUSE). A patch reverts algif_aead.c to stop the behavior; mitigations include updating kernels or disabling the algif_aead module, with public disclosure on April 29, 2026 and Kubernetes container escape implications.

via CyberSecurityNews|

#copy-fail #cve-2026-31431 #cybersecurity