CISA Adds ‘Copy Fail’ to KEV After 10-Line Linux Exploit

The U.S. Cybersecurity and Infrastructure Security Agency added the Linux vulnerability known as ‘Copy Fail’ to its Known Exploited Vulnerabilities catalog on Saturday, saying it poses significant risks to the federal enterprise. Researchers reported a 732-byte Python exploit that can escalate privileges to root on major open-source Linux distributions released since 2017, but the exploit requires prior code execution on the target system.

Researchers and independent developers flagged the issue in late March. Miguel Angel Duran described the exploit as requiring only ’10 lines of Python’ to gain root. A developer using the online name Xint Code characterized it as a trivially exploitable logic bug affecting major distributions from the past nine years.

Brian Pak, chief executive of cybersecurity firm Theori, reported privately notifying the Linux kernel security team on March 23 and collaborating with maintainers on fixes. Patches were merged into the Linux mainline kernel on April 1, a CVE was assigned on April 22, and a public write-up and proof-of-concept were posted on April 29.

Vendors and distribution maintainers have released updated kernels or backports for affected versions. Administrators are advised to apply those updates promptly and to follow vendor guidance for mitigation.

Because the exploit escalates privileges rather than executing code remotely on its own, an attacker must already have a foothold on a system-for example via a separate remote code execution flaw, malware run by a user, or compromised credentials-before the Python script can be used to obtain root.

Linux is widely used across cloud services, web infrastructure and cryptocurrency operations, including exchanges and blockchain nodes. Security teams are advised to verify kernel versions, review logs and intrusion-detection alerts for signs of initial compromise, and monitor for attempts to use privilege-escalation techniques.

Researchers continue to urge rapid patching and monitoring because the exploit is small and portable and can be applied across multiple distributions.