Exploitation of ‘Copy Fail’ Linux Vulnerability Begins

“Successful exploitation leads to full root privilege escalation (high impact to confidentiality, integrity, and availability) and could facilitate container breakout, multi-tenant compromise, and lateral movement within shared environments,” Microsoftnotes.“Its reliability, stealth (in-memory-only modification), and cross-platform applicability make it particularly dangerous in cloud, CI/CD, and Kubernetes environments where untrusted code execution is common,” the company says.Copy Fail, Microsoft warns, can be exploited by any local, unprivileged user, and can be chained with Secure Shell (SSH) access, malicious CI jobs, or access to containers to achieve root shell access.An attack chain would begin with reconnaissance to identify a container running a vulnerable kernel and continue with the execution of a small script to overwrite in-memory data and elevate privileges.According to Microsoft, organizations should prioritize identifying potentially vulnerable machines in their environments, apply patches, isolate the systems, apply access controls, and review logs for signs of exploitation.Related:SonicWall Urges Immediate Patching of Firewall VulnerabilitiesRelated:No Patch for New PhantomRPC Privilege Escalation Technique in WindowsRelated:Incomplete Windows Patch Opens Door to Zero-Click AttacksRelated:OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

“Its reliability, stealth (in-memory-only modification), and cross-platform applicability make it particularly dangerous in cloud, CI/CD, and Kubernetes environments where untrusted code execution is common,” the company says.Copy Fail, Microsoft warns, can be exploited by any local, unprivileged user, and can be chained with Secure Shell (SSH) access, malicious CI jobs, or access to containers to achieve root shell access.An attack chain would begin with reconnaissance to identify a container running a vulnerable kernel and continue with the execution of a small script to overwrite in-memory data and elevate privileges.According to Microsoft, organizations should prioritize identifying potentially vulnerable machines in their environments, apply patches, isolate the systems, apply access controls, and review logs for signs of exploitation.Related:SonicWall Urges Immediate Patching of Firewall VulnerabilitiesRelated:No Patch for New PhantomRPC Privilege Escalation Technique in WindowsRelated:Incomplete Windows Patch Opens Door to Zero-Click AttacksRelated:OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

Copy Fail, Microsoft warns, can be exploited by any local, unprivileged user, and can be chained with Secure Shell (SSH) access, malicious CI jobs, or access to containers to achieve root shell access.An attack chain would begin with reconnaissance to identify a container running a vulnerable kernel and continue with the execution of a small script to overwrite in-memory data and elevate privileges.According to Microsoft, organizations should prioritize identifying potentially vulnerable machines in their environments, apply patches, isolate the systems, apply access controls, and review logs for signs of exploitation.Related:SonicWall Urges Immediate Patching of Firewall VulnerabilitiesRelated:No Patch for New PhantomRPC Privilege Escalation Technique in WindowsRelated:Incomplete Windows Patch Opens Door to Zero-Click AttacksRelated:OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

An attack chain would begin with reconnaissance to identify a container running a vulnerable kernel and continue with the execution of a small script to overwrite in-memory data and elevate privileges.According to Microsoft, organizations should prioritize identifying potentially vulnerable machines in their environments, apply patches, isolate the systems, apply access controls, and review logs for signs of exploitation.Related:SonicWall Urges Immediate Patching of Firewall VulnerabilitiesRelated:No Patch for New PhantomRPC Privilege Escalation Technique in WindowsRelated:Incomplete Windows Patch Opens Door to Zero-Click AttacksRelated:OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

According to Microsoft, organizations should prioritize identifying potentially vulnerable machines in their environments, apply patches, isolate the systems, apply access controls, and review logs for signs of exploitation.Related:SonicWall Urges Immediate Patching of Firewall VulnerabilitiesRelated:No Patch for New PhantomRPC Privilege Escalation Technique in WindowsRelated:Incomplete Windows Patch Opens Door to Zero-Click AttacksRelated:OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

Related:SonicWall Urges Immediate Patching of Firewall VulnerabilitiesRelated:No Patch for New PhantomRPC Privilege Escalation Technique in WindowsRelated:Incomplete Windows Patch Opens Door to Zero-Click AttacksRelated:OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

Related:No Patch for New PhantomRPC Privilege Escalation Technique in WindowsRelated:Incomplete Windows Patch Opens Door to Zero-Click AttacksRelated:OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

Related:Incomplete Windows Patch Opens Door to Zero-Click AttacksRelated:OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

Related:OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

Ionut Arghire is an international correspondent for SecurityWeek.

Source: SecurityWeek