CopyFail works on ppc64le


Usually exploits like CopyFail tend to have PoCs or exploits that are architecture-specific. Not this one. Patches should be coming real soon now. Exploit tested using this deobfuscated version.

% arch
ppc64le
% make
cc -Wall -Wextra -Os payload.c -o payload
% python3 poc.py
uid=0(root) [...] context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.

Alternatively, disable the defective kernel module (adjust for your distro, as root). This may not always be possible; on my Fedora system I got rmmod: ERROR: Module algif_aead is builtin. In that case, you're going to be building a new kernel with AF_ALG disabled.

# echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
# rmmod algif_aead

To revert:

# rm /etc/modprobe.d/disable-algif-aead.conf
# modprobe algif_aead

Comments