Post #1848691
2026-04-30 10:10 UTC
Note that if you the #copyfail exploit on your session, any terminal in it will be able to su without authentication (until next reboot I assume).
hotpatch:
https://lilting.ch/en/articles/linux-copy-fail-page-cache-root
Replies (1)
-
@AthanSpod@social.linux.pizza 2026-04-30 10:35
@JennyFluff@chitter.xyz You can `echo 1 > /proc/sys/vm/drop_caches` to drop the caches, after you've done something like: $ cd /etc/modprobe.d $ cat > af_alg.conf blacklist af_alg blacklist algif_aead $ which blacklists the modules. Now, if you have legitimate use of af_alg, you can decide to only `blacklist algif_aead`, which worked to block the exploit on my Debian 13/trixie desktop running a locally-compiled 6.18.25 kernel. Dropping the caches clears what the exploit did (changing the contents of the cached version of `/usr/bin/su`, so that cached version is always used, not the on-disk version). #copyfail