Skip to main content
Ask Ubuntu

Return to Revisions

2 of 6
Added a bit more detail on mitigation
Cromefire_
Cromefire_
  • 31
  • 1
  • 3

The issue should be mitigated for now thanks to USN-8226-1 and USN-8226-2. It more or less applies the same mitigations suggested by the researchers, but right in kmod and through an update. While the website may be down, the security email list continues to work apparently.

The description of this USN reads:

kmod has been updated to block loading of the algif_aead kernel module.

It suggest the following updates:

Ubuntu 25.10 kmod 34.2-2ubuntu1.1

Ubuntu 24.04 LTS kmod
31+20240202-2ubuntu7.2

Ubuntu 22.04 LTS kmod 29-1ubuntu1.1

Ubuntu 20.04 LTS kmod 27-1ubuntu2.1+esm1 Available with Ubuntu Pro

Ubuntu 18.04 LTS kmod 24-1ubuntu3.5+esm1 Available with Ubuntu Pro

Ubuntu 16.04 LTS kmod 22-1ubuntu5.2+esm1 Available with Ubuntu Pro

Ubuntu 14.04 LTS kmod 15-0ubuntu7+esm1 Available with Ubuntu Pro

This mitigation can be applied using:

~$ sudo apt update && sudo apt upgrade kmod

I've not been able to verify what happens without a reboot or before installing that update yet, but after installation the exploit no longer works on my test server:

~$ python3 copy_fail_exp.py                         
Traceback (most recent call last):                                             
  File "/tmp/copy_fail_exp.py", line 9, in <module>                            
    while i<len(e):c(f,i,e[i:i+4]);i+=4                                        
                   ^^^^^^^^^^^^^^^                                             
  File "/tmp/copy_fail_exp.py", line 5, in c                                   
    a=s.socket(38,5,0);a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"));h=2
79;v=a.setsockopt;v(h,1,d('0800010000000010'+'0'*64));v(h,5,None,4);u,_=a.accep
t();o=t+4;i=d('00');u.sendmsg([b"A"*4+c],[(h,3,i*4),(h,2,b'\x10'+i*19),(h,4,b'\
x08'+i*3),],32768);r,w=g.pipe();n=g.splice;n(f,w,o,offset_src=0);n(r,u.fileno()
,o)                                                                            
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^    
FileNotFoundError: [Errno 2] No such file or directory

It looks like binding to an aead socket was successfully prevented.

They link the following blog and notices (may be not reachable now, but for future reference):

Kernel patches will probably become available in the near future as well, but due to the current state of the websites it is rather hard to get up-to-date information and I've yet to receive an email about it.

Cromefire_
  • 31
  • 1
  • 3