[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAKXLc7dbALVK=jV4p9gcAD33LK44fjSan2YX7RYm7J7Qt-mg4g@mail.gmail.com>
Date: Fri, 8 May 2026 14:59:33 +0200
From: Kalin KOZHUHAROV <kalin@...nrope.net>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Dirty Frag: Universal Linux LPE
On Fri, May 8, 2026 at 6:39 AM Daniel Tang
<danielzgtg.opensource@...il.com> wrote:
>
> > no patches [...] exist
>
Well patches will eventually come, but mitigation across the board hit
a few snags already, so from my lessons learned I baked a script to
apply the mitigation.
Actually renaming the modules, not relying on modprobe config, since
there are some distros that don't have that by default.
After some initial testing and with GNU parallel as (often) last
resort mass deployment tool, I just released it on
https://github.com/thinrope/cf-df in the hope that I may save some
minutes or hours of someones' job. The script itself is useful on its
own, to be deployed via any configuration management system, or run by
hand.
Any feedback/issues/PR are welcome.
Here is the README (reformatted to plaintext for clarity):
===================================================================
https://github.com/thinrope/cf-df
=== copy.fail + Dirty Frag patching-on-the-fly ===
Patch copy.fail[1] and Dirty frag[2] related CVEs
== Why? ==
I suddenly needed to patch a multitude of linux hosts in various
platforms with minimal impact. I don't trust the suggested method of
disabling module loading, I'd rather have the file renamed (or even
deleted at some point).
== How? ==
Execute the cf+df_patching.sh script as root on any host. Use and
configuration management system you have in place. Alternatively, for
those odd mass cases, use the wonderful GNU parallel[5] from a central
host via ssh (run as root, ssh as root[3,4]):
git clone https://github.com/thinrope/cf-df.git
cd cf-df
$EDITOR target.list
parallel --tag --nonall --slf target.list --workdir ... --transferfile
cf+df_patching.sh --cleanup 'bash cf+df_patching.sh'
== References ==
[1] copy.fail: https://copy.fail/
[2] Dirty frag: https://github.com/V4bel/dirtyfrag
[3] If you cannot login via ssh directly as root, use sudo properly
[4] ... or abuse these CVEs before you patch to obtain root :-D
[5] GNU parallel: https://www.gnu.org/software/parallel/
===================================================================
Regards,
Kalin.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
