[Discuss] Copy Fail

[Dan Ritter]

Rich Pieri wrote: 
> This one is bad. Really bad. Rilly-Rilly-Super-Duper-Ultra bad.
> Patch or mitigate now.
> 
> https://xint.io/blog/copy-fail-linux-distributions


I personally would reserve a double-Rilly-Super-Duper level of
badness for a remote code execution.

This is "just" another local privilege escalation attack.

If you're not running one of the wifi stacks that require it,

   For immediate mitigation, block AF_ALG socket creation via seccomp
   or blacklist the algif_aead module:

   echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
   rmmod algif_aead 2>/dev/null

Not a terrible mitigation.

-dsr-