CISA Flags Critical Linux 'Copy Fail' Security Vulnerability
Security experts reveal that threat actors who already have code execution capabilities could obtain root privileges on Linux machines with a simple 10-line Python exploit.
Security researchers have identified a recently uncovered security weakness that has the potential to impact the majority of primary open-source Linux distributions that have been released from 2017 onward.
The security weakness, dubbed "Copy Fail," drew the focus of the US Cybersecurity and Infrastructure Agency (CISA), which incorporated it into their Known Exploited Vulnerabilities (KEV) catalog this past Saturday, cautioning that it presents "significant risks to the federal enterprise."
"10 lines of Python" may be all it takes: Researcher
The security flaw has the potential to enable malicious parties to obtain root-level access on numerous Linux systems through the use of a 732-byte Python script, although the exploit necessitates existing code execution capabilities on the target system before privileges can be escalated.
Security researcher Miguel Angel Duran stated that gaining root permissions on any vulnerable system demands merely "10 lines of Python."
"This Linux vulnerability is insane," Duran said.
The Linux operating system is extensively deployed by cryptocurrency exchanges, blockchain nodes and custodial services, primarily because of its strong security features and operational efficiency, which indicates that this vulnerability has the potential to present dangers to the cryptocurrency sector should threat actors successfully obtain initial system access.
Exploit was initially reported in March
In a post shared on X this past Saturday, Xint Code indicated that the security flaw "is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years."
"A small, portable python script gets root on all platforms," Xint Code said.
In a Saturday post on X, Brian Pak, who serves as CEO of cybersecurity company Theori, revealed that he submitted a report regarding the vulnerability "privately" to the Linux kernel security team on March 23.
"We worked with them on patches, which landed in mainline on April 1. CVE assigned April 22. We disclosed publicly on April 29 with a full write-up and PoC," Pak said.