[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87jytkb2gv.fsf@gentoo.org>
Date: Sun, 03 May 2026 22:36:00 +0100
From: Sam James <sam@...too.org>
To: oss-security@...ts.openwall.com
Cc: Taeyang Lee <0wn@...ori.io>, Brad Spengler <spender@...ecurity.net>
Subject: Re: Precise disclosure contents for copyfail (Re:
CVE-2026-31431: CopyFail: linux local privilege scalation)
Sam James <sam@...too.org> writes:
> Jan Schaumann <jschauma@...meister.org> writes:
>
>> Hi,
>>
>> This is currently making the rounds and looks pretty
>> severe:
>>
>> https://copy.fail/
>>
>> A local privilege escalation vulnerability with a
>> working PoC python script exploiting a logic flaw in
>> the kernel crypto API (AF_ALG) affecting most Linux
>> distributions.
>>
>> More detailed write-up:
>> https://xint.io/blog/copy-fail-linux-distributions
>>
>> [...]
>
> Are we aware of what precisely xint disclosed to the kernel security
> team?
>
> My assumption based on the tool output in the write-up is that enough
> was disclosed to know this was at least an easily-exploitable LPE (*).
It's been pointed out to me that Brad Spengler has commented on X [0],
linking to Brian Pak of xint saying [1]:
> We also provided a fully working exploit to the kernel security team
> when we reported. We’ve since learned that such details don’t
> automatically get forwarded downstream and that Linux kernel commit
> messages are typically kept minimal. That’s simply how the process works.
So yes, the kernel team were very much aware of the impact from the
offset.
I hadn't seen Brian's thread until now, it is interesting reading [2].
Thanks to Brad and the person who sent me the link to the tweet.
>
> (*) Because part of their promotion here is for the tool's ability to
> get the analysis right, so it implies that they didn't figure it out
> later, and that the tool did "most of the work". Whether or not that's
> actually the case, I of course don't know.
>
> thanks,
> sam
[0] https://xcancel.com/spendergrsec/status/2051045704487829878
[1] https://xcancel.com/brian_pak/status/2050255271184994538
[2] https://xcancel.com/brian_pak/status/2050255258098766101#m
Download attachment "signature.asc" of type "application/pgp-signature" (419 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
