New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions

Copy Fail is a Linux local privilege escalation vulnerability that stems from a logic flaw in the Linux kernel's cryptographic subsystem, specifically within the algif_aead module. The issue was introduced in August 2017. An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system. The exploit involves opening an AF_ALG socket, binding to authencesn(hmac(sha256),cbc(aes)), constructing shellcode payload, triggering write operation to kernel's cached copy of /usr/bin/su, and calling execve to load injected shellcode as root. The vulnerability allows corruption of page cache of setuid binaries and has cross-container impacts as page cache is shared across all processes. A 732-byte Python script can reliably exploit this without race conditions or kernel offsets.