Post #1799752

2026-04-29 22:02 UTC

Quickly dove into the copy.fail exploit. 1. Yes, it's real. 2. Current chain can write any arbitrary content to any user-readable file (into the page cache). 3. Current chain relies on an available target suid binary that you can open() as a lowpriv user. 4. Current exploit relies on that binary being /bin/su and then being able to execve(/bin/sh, 0, 0) (which doesn't work on alpine, etc.). The former is easily replaced in the code. The latter needs a rebuilt payload ELF (also easy).

Replies (6)

@q3k@social.hackerspace.pl 2026-04-29 22:05

5. The authors say they have other chains (including ones that allow container escapes). I believe them. 6. A mildly de-minified PoC for Alpine with a new payload ELF is at hackerspace[pl]/~q3k/alpine.py . You'll need /bin/ping from iputils. Tested on an ancient Alpine ISO from my cringe^Wdownloads directory.

Open ##2142668
@wolf480pl@mstdn.io 2026-04-29 22:13

@q3k would this primitive also work for overwriting code of an already-running privileged process?

Open ##2142676
@hillu@infosec.exchange 2026-04-29 22:32

@q3k Another route would be to patch a root password hash into /etc/passwd (yes, that still works though shadow passwords have been a thing for decades) and use any login mechanism with that password.

Open ##2142685
@astraleureka@social.treehouse.systems 2026-04-29 23:42

@q3k working around the broken execve is trivial enough like you said; https://social.treehouse.systems/@astraleureka/116490148181953204 it's pretty amusing seeing the trodden pagecache results persist afterwards

Open ##2142686
@penguin42@mastodon.org.uk 2026-04-29 23:48

@q3k So I guess you can disable it by a seccomp or bpf that blocks hmm, socket(2) with AF_ALG ?

Open ##2142687
@moses_izumi@fe.disroot.org 2026-05-02 15:17

@q3k Is it common for security researchers to obfuscate their proof-of-concept exploits? 'cause it absolutely shouldn't be. (I don't read about exploits that often, but it's a part of the copyfail saga that stands out)

Open ##2142696