Uh oh, Copy-Fail exploit on Linux

[allusive]

Revealed just hours ago.

GitHub - rootsecdev/cve_2026_31431: Exploit POC for CVE_2026_31431

Exploit POC for CVE_2026_31431. Contribute to rootsecdev/cve_2026_31431 development by creating an account on GitHub.

github.com

https://copy.fail/

https://www.cve.org/CVERecord?id=CVE-2026-31431

I ran the Python code from Github and it really works. Run the script with --shell, it prompts for your password and you are dropped into a root shell.
Control-d out of that and this kind of thing happens:

$ whoami
whoami: cannot find name for user ID 1000

 

[cschuber]

It only works on systems with users in passwd(5). Network accounts such as those in A/D or LDAP, as used in most enterprise environments, it will not work.

It does not work on Fedora 44.

This also depends on the underlying hardware. It will work on a physical machine. It was not able to work on a RHEL 10 system in a VMware VM.

 

[PHolder]

This also depends on the underlying hardware.

The exploit is coded for x86 machines, it won't work on ARM. It may also be coded to expect a certain arrangement of the binary it attacks (which is /usr/bin/su by default.) The underlying attack works on almost any machine, unless the kernel settings were modified to prevent or restrict the use of the underlying exploited kernel code. Definitely everyone should be expecting to apply a patch in the future, as the kernel is being revved to address the code that was added in 2017 that caused the problem.

 

[cschuber]

Still waiting for Red Hat patches...

 

[AlanD]

Installed the patches on 4 Debian servers last night.

 

[cschuber]

Red Hat came out with patches today. Oracle did May 1.

BTW the issue can be mitigated by blacklisting the module until patches are applied.

 

[allusive]

I updated Debian a couple days ago. Updating the kernel killed the Broadcom Wifi driver so I had to rebuild it, but other than that it was painless.

 

[cschuber]

Having tested the C exploit on a patched RHEL 10 system. The Red Hat patch does NOT fix the problem. It does mitigate the python exploit. All an attacker needs to do is build the exploit static, i.e. gcc -static. Then copy the exploit binary without having to worry about glibc incompatibilities. For that matter the binary I built on Fedora 44 will work on any Linux system.

 

[PHolder]

The Red Hat patch does NOT fix the problem.

Do you know what does the patch do? The "correct" fix is a kernel change, as I understand it... basically rolling back out the bad/unnecessary "optimization" that was added in 2017.

 

[cschuber]

The patch only addresses one vulnerability. The exploit uses a socket, chaining two vulnerabilities together to bypass the the fix. The mitigation is to blacklist the esp modules the exploit uses to pass dirty fragments, via a socket. Certainly clever.

 

[cschuber]

The mitigation requires a reboot. My testing to see if I could mitigate without a reboot, modprobe -b, is untested, i.e. I cannot deploy to the farm through Ansible because they run MDE and MDE caught onto me. I'll try my no-reboot mitigation tomorrow in a Fedora VM without MDE. In the mean time the only fully tested solution is one that requires a reboot.

It didn't take long for the heuristics to see what I was up to and put a stop to it. Oh well. I'll continue work on this tomorrow.

 

[cschuber]

Looking at it further, this is a brand new exploit not related to CVE-2026-31431. There is no CVE for it yet.

We're in a brand new world.

Now I finally do take the evening off from $JOB.

 

[cschuber]

The new exploit, dirtyfrag, has two CVEs now. Seems there's a weakness in the Linux kernel wrt securing of the page cache. That's three vulnerabilities targeting the same piece of code in the kernel. Expect many more until they've possibly rewritten that portion of memory management. I expect this to be much bigger, maybe memory management in general.

And, not just Linux servers but consider our Android phones and Linux based appliances like TVs. What a mess.

Let's not feel smug if we don't use Linuix. I'm sure Windows and the BSDs have their own disasters waiting to be discovered.

 

[PHolder]

https://www.theregister.com/securit...th-no-patches-and-public-root-exploit/5237230 Apparently the embargo on it was broken somehow before they had any patches ready.

 

[cschuber]

https://www.theregister.com/securit...th-no-patches-and-public-root-exploit/5237230 Apparently the embargo on it was broken somehow before they had any patches ready.

Yup. That's what happened. He even mentions it on his github page.

The exploit is nasty. The mitigation is pedestrian but works to circumvent the issue until patches are merged. There is one patch in the Linux mainline that already addresses one of the flaws. There are five more slated to go into the net development repo.

 

[cschuber]

And now, Fragnesia. The same class of bug that made Pipe Fail, Copy Fail, and DIrty Frag possible. Fragnesia is even worse because the attacker corrupts the page cache of any file the attacker can read, like passwd or su. Even though the Dirty Frag patches won't protect you, the Dirty Frag mitigations will.