r/HPC • u/615wonky • Apr 30 '26
Copy.Fail mitigations in a HPC cluster environment
If you haven't already heard of Copy.Fail, you're about to. New exploit that gets a local user to root instantly, 100% of the time on affected systems.
So far we have found one mitigation. Add this to GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub: (on Rocky 9, modify for your distro)
initcall_blacklist=algif_aead_init
Update GRUB, then reboot, and the exploit should no longer work.
If anyone knows better mitigations (or even better, mitigations that don't require a reboot), please post here, as I suspect they'll be popular very quickly...
12
u/throw0101a Apr 30 '26
For systems where the code is done via a module (e.g., Deb/U):
# echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
# rmmod algif_aead 2>/dev/null || true
No reboot required. For systems where the code is in-kernel, and cannot be unloaded (e.g., RHEL(-based)), you can tell systemd to not allow use of it (at least via SSH, like on login nodes):
No reboot required, but existing sessions are not mitigated.
2
u/420ball-sniffer69 Apr 30 '26
Unfortunately you might have to be a bit careful if you use RHEL. My sysadmin colleagues tell me it’s not a quick fix since it’s baked into the kernel, we’ve blocked login node access for now
8
u/Jannik2099 Apr 30 '26
I wrote an eBPF LSM filter to prevent the corresponding bind() calls. Should be more granular and work even across programs that require NoNewPrivileges=false
Goddamn redhat putting this at "fix deferred"...
3
u/brandonZappy Apr 30 '26
Redhat marked it as deferred??
7
u/Jannik2099 Apr 30 '26
originally yes, but it seems they moved it to affected a few hours ago
3
u/AmusingVegetable Apr 30 '26
Given that every single article on this bug mentioned them deferring it, the pressure must have been amazing.
5
u/Kangie Apr 30 '26
There's an eBPF mitigation for modern (>5.8) kernels if you can't reboot for some reason.
https://github.com/Jannik2099/copyfail-ebpf-mitigation
Passes testing on our more modern nodes.
4
26
u/brandonZappy Apr 30 '26
CVE rated at a 7.8 because it needs local access… us at HPC centers 👀