复制失败 – CVE-2026-31431
Copy Fail – CVE-2026-31431

原始链接: https://copy.fail/

## Copy-Fail 内核漏洞:概要 一个严重的漏洞“Copy-Fail”影响了2017年至最近修复版本之间的Linux内核——影响几乎所有主流发行版(Ubuntu, RHEL, Amazon Linux, SUSE, Debian, Arch, Fedora等)。它允许本地非特权用户无需网络连接或调试功能即可获得root权限。 该漏洞利用了内核的加密API (AF_ALG),该API默认启用。**高风险环境包括多租户系统(共享服务器、Kubernetes集群、CI/CD 运行器和云SaaS平台)**,其中受损用户可以升级权限以影响整个系统或其他租户。 虽然对于单用户系统来说不太关键,但它仍然可以将任何本地代码执行提升到root权限。**强烈建议立即打补丁**,尤其是在共享环境中,以防止潜在的完全系统被破坏。

Hacker News 新闻 | 过去 | 评论 | 提问 | 展示 | 工作 | 提交 登录 复制失败 – CVE-2026-31431 (copy.fail) 13 分,由 unsnap_biceps 发表于 17 分钟前 | 隐藏 | 过去 | 收藏 | 3 条评论 帮助 not_your_vase 发表于 6 分钟前 | 下一个 [–] 有没有现成的可读漏洞版本? 承认我两次没通过用肉眼解析二进制压缩文件的课程。 Lorin 发表于 2 分钟前 | 上一个 [–] 命名 CVE 和单个域名的逻辑是什么? 营销? ronsor 发表于 1 分钟前 | 父评论 [–] 这确保了人们不会忘记这些漏洞,至少。 考虑申请 YC 2026 夏季批次! 申请截止至 5 月 4 日 指南 | 常见问题 | 列表 | API | 安全 | 法律 | 申请 YC | 联系方式 搜索:
相关文章

原文

If your kernel was built between 2017 and the patch — which covers essentially every mainstream Linux distribution — you're in scope.

Copy Fail requires only an unprivileged local user account — no network access, no kernel debugging features, no pre-installed primitives. The kernel crypto API (AF_ALG) ships enabled in essentially every mainstream distro's default config, so the entire 2017 → patch window is in play out of the box.

Distributions we directly verified:

DistributionKernel
Ubuntu 24.04 LTS6.17.0-1007-aws
Amazon Linux 20236.18.8-9.213.amzn2023
RHEL 14.36.12.0-124.45.1.el10_1
SUSE 166.12.0-160000.9-default

These are what we tested directly. Other distributions running affected kernels — Debian, Arch, Fedora, Rocky, Alma, Oracle, the embedded crowd — behave the same. Tested it elsewhere? Open an issue to add to the list.

Should you patch first?

High

Multi-tenant Linux hosts

Shared dev boxes, shell-as-a-service, jump hosts, build servers — anywhere multiple users share a kernel.

any user becomes root

High

Kubernetes / container clusters

The page cache is shared across the host. A pod with the right primitives compromises the node and crosses tenant boundaries.

cross-container, cross-tenant

High

CI runners & build farms

GitHub Actions self-hosted runners, GitLab runners, Jenkins agents — anything that executes untrusted PR code as a regular user, on a shared kernel.

a PR becomes root on the runner

High

Cloud SaaS running user code

Notebook hosts, agent sandboxes, serverless functions, any tenant-supplied container or script.

tenant becomes host root

Medium

Standard Linux servers

Single-tenant production where only your team has shell access.

internal LPE; chains with web RCE or stolen creds

Lower

Single-user laptops & workstations

You're already the only user. The bug doesn't grant remote attackers access by itself, but any local code execution becomes root.

post-exploitation step-up

联系我们 contact @ memedata.com