3 ms·

It does not behave as described on EndeavorOS (arch-based) running kernel 6.19.14-arch1-1. I receive the error: Password: su: Authentication token manipulation

It does not behave as described on EndeavorOS (arch-based) running kernel 6.19.14-arch1-1. I receive the error: Password: su: Authentication token manipulation error I'm guessing this means it's already patched?

dimastopel 6mo ago
same result on my arch machine as well.
john_strinlai 6mo ago
yes, it was reported on march 23rd, patches on april 1. you are reading about it now because it has been patched.
- marshray 6mo ago
  No it hasn't. Ubuntu before 26.04 LTS (released a week ago) are currently listed as vulnerable. Debian other than forky and sid are currently listed as vulnerable. This is a disgrace.
  - john_strinlai 6mo ago
    Disclosure timeline 2026-03-23Reported to Linux kernel security team 2026-03-24Initial acknowledgment 2026-03-25Patches proposed and reviewed 2026-04-01Patch committed to mainline 2026-04-22CVE-2026-31431 assigned 2026-04-29Public disclosure (https://copy.fail/) kernel 6.19.14-arch1-1, the kernel in question from the parent comment, has been patched.
    - marshray 6mo ago
      The lesson here being... compile your own kernel from git sources every few days? Give up entirely on non-virtualized container security? This is not sarcasm. I'd finally given in and started learning about docker/podman-style OCI containerization last week.
      - john_strinlai 6mo ago
        in this specific case, they offer an alternative mitigation if your chosen distro has not updated yet: For immediate mitigation, block AF_ALG socket creation via seccomp or blacklist the algif_aead module: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf rmmod algif_aead 2>/dev/null
        marshray 6mo ago
        Thanks! I'd do 'umask 133' in front of the echo out of paranoia. Out of curiosity, was the asterisk after '2>/dev/null' intentional? I had not seen that idiom before.
        john_strinlai 6mo ago
        the asterisk is my oops, trying to format the comment in italics to differentiate my comment from the text provided by the author. sorry for the confusion
        ranger_danger 6mo ago
        And I would do chattr +i disable-algif.conf
      - x4132 6mo ago
        are you sure containerization would be more secure? this is also a rootless podman escape. the lesson here is to not give random people shell access to your systems.
        marshray 6mo ago
        No, I meant that I'd resisted doing anything with Docker for its entire existence and just finally gave in and started messing with podman. I have amazing timing.
      - DooMMasteR 6mo ago
        I mean, most Kernel version literally got the patch 2026.04.30, so just today.

dimastopel 6mo ago

same result on my arch machine as well.

john_strinlai 6mo ago

yes, it was reported on march 23rd, patches on april 1. you are reading about it now because it has been patched.

marshray 6mo ago
No it hasn't. Ubuntu before 26.04 LTS (released a week ago) are currently listed as vulnerable. Debian other than forky and sid are currently listed as vulnerable. This is a disgrace.
- john_strinlai 6mo ago
  Disclosure timeline 2026-03-23Reported to Linux kernel security team 2026-03-24Initial acknowledgment 2026-03-25Patches proposed and reviewed 2026-04-01Patch committed to mainline 2026-04-22CVE-2026-31431 assigned 2026-04-29Public disclosure (https://copy.fail/) kernel 6.19.14-arch1-1, the kernel in question from the parent comment, has been patched.
  - marshray 6mo ago
    The lesson here being... compile your own kernel from git sources every few days? Give up entirely on non-virtualized container security? This is not sarcasm. I'd finally given in and started learning about docker/podman-style OCI containerization last week.
    - john_strinlai 6mo ago
      in this specific case, they offer an alternative mitigation if your chosen distro has not updated yet: For immediate mitigation, block AF_ALG socket creation via seccomp or blacklist the algif_aead module: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf rmmod algif_aead 2>/dev/null
      - marshray 6mo ago
        Thanks! I'd do 'umask 133' in front of the echo out of paranoia. Out of curiosity, was the asterisk after '2>/dev/null' intentional? I had not seen that idiom before.
        john_strinlai 6mo ago
        the asterisk is my oops, trying to format the comment in italics to differentiate my comment from the text provided by the author. sorry for the confusion
        ranger_danger 6mo ago
        And I would do chattr +i disable-algif.conf
    - x4132 6mo ago
      are you sure containerization would be more secure? this is also a rootless podman escape. the lesson here is to not give random people shell access to your systems.
      - marshray 6mo ago
        No, I meant that I'd resisted doing anything with Docker for its entire existence and just finally gave in and started messing with podman. I have amazing timing.
    - DooMMasteR 6mo ago
      I mean, most Kernel version literally got the patch 2026.04.30, so just today.