Quickly dove into the copy.fail exploit.
1. Yes, it's real.
2. Current chain can write any arbitrary content to any user-readable file (into the page cache).
3. Current chain relies on an available target suid binary that you can open() as a lowpriv user.
4. Current exploit relies on that binary being /bin/su and then being able to execve(/bin/sh, 0, 0) (which doesn't work on alpine, etc.). The former is easily replaced in the code. The latter needs a rebuilt payload ELF (also easy).
q3k 🚄 MRMCD (📞4735)
npub17j…kxv95
2026-04-29 22:02:21 UTC
Author Public Key
npub17j830nenjvjwcwhmmmfa8w6q4jhddpxgfyl4fvvkwtvlxq2pns9s5kxv95Seen on
wss://relay.ditto.pubPublished at
2026-04-29 22:02:21 UTCEvent JSON
{
"id": "7954e63c3f429046472b8e60db9aba97c7d140f4fbbeab092baf281127f7612a",
"pubkey": "f48f17cf339324ec3afbded3d3bb40acaed684c8493f54b19672d9f301419c0b",
"created_at": 1777500141,
"kind": 1,
"tags": [
[
"proxy",
"https://social.hackerspace.pl/users/q3k/statuses/116490249266904439",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "Quickly dove into the copy.fail exploit.\n\n1. Yes, it's real.\n2. Current chain can write any arbitrary content to any user-readable file (into the page cache).\n3. Current chain relies on an available target suid binary that you can open() as a lowpriv user.\n4. Current exploit relies on that binary being /bin/su and then being able to execve(/bin/sh, 0, 0) (which doesn't work on alpine, etc.). The former is easily replaced in the code. The latter needs a rebuilt payload ELF (also easy).",
"sig": "7b0de698f14260c431f7a8855597f8f2af0d3d39d02f22e4c8d3558b015ddea8279907f8eb0926cec7e4a987dcdadfaba57b35626ea2b0af196c501704d25bdf"
}