Critical “Copy Fail” Vulnerability in Linux Grants Root Access
A bug in the Linux kernel that has been hidden since 2017 has now received a public proof-of-concept (PoC) and is quite serious. The vulnerability resides in the kernel’s crypto engine.
An attacker sends a decryption request that intentionally fails, but the kernel writes their data to memory before checking its validity. This write operation ends up in the page cache, the in-RAM copy of system files.
From there, an attacker can overwrite their own User ID in the cached version of /etc/passwd, changing it from 1000 to 0. The operating system then assumes the attacker is root. All of this fits into a 732-byte Python script.
Update your kernels. If you are running containerized workloads, consider this a risk for container escape.
CVSS: 7.8 with local privilege escalation, affecting nearly all major Linux distributions.