הצטרף ל-Nostr
2026-04-30 15:38:34 CEST
in reply to

Will Dormann on Nostr: If you're curious about IOCs for copyfail, look in syslog for:NET: Registered PF_ALG ...

If you're curious about IOCs for copyfail, look in syslog for:NET: Registered PF_ALG protocol family

for attempts to exploit copyfail on systems that use the vulnerable code as a module. For systems that have the vulnerable code compiled into the kernel, like RHEL, you'll see this line on every boot.
And at least for this particular flavor of exploit, a wall-clock nearby:process 'su' launched '/bin/sh
with NULL argv: empty string added`
is an indication of successful exploitation.

But it's worth noting that the "process launched" stuff is merely what the ITW PoC will leave behind. More clever exploitation may not be as obvious.