undefined | Better HN

0 points1p09gj20g8h1mo ago0 comments

Where are you seeing the disabling algif_aead mitigation?

0 comments

3 comments · 1 top-level

oskarkk1mo ago· 2 in thread

In TFA: https://copy.fail/#mitigation

> Before you can patch: disable the algif_aead module.

> echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf

> rmmod algif_aead 2>/dev/null || true

Edit: and I can confirm that on my system with kernel 6.19.8 the above fixes the exploit.

comfydragon1mo ago

Weirdly, the mitigation does not seem to work under WSL2 (at least in Ubuntu 24.04).

    Linux wsl2 6.6.87.2-microsoft-standard-WSL2 ...

`modprobe algif_aead` errors out, but if I run the POC, it succeeds.

Outside of WSL2, the mitigation does appear to work though.

tremon1mo ago

It's possible that the WSL kernel has that code compiled-in rather than as a loadable module. If they ship the kernel config somewhere, you could verify with

  zgrep CRYPTO_USER_API_AEAD /proc/config.gz /boot/config-*

It should show =m if it's a loadable module, and =y if it's compiled in.

1 more reply

j / k navigate · click thread line to collapse