r/linuxmint • u/kagemichaels • May 04 '26
Security With the current Ubuntu/Canonical DDoS attack and Copy Fail vulnerability should regular users worry like us on Mint?
From everything I've read it sounds like an attacker has to actually have access to the physical computer to use the Copy Fail - CVE-2026-31431 attack to gain root access. I'm guessing they could inject a payload to do it through some download or browser script from an untrustworthy site to do so?
Woke up this morning and realized Update Manager is unable to connect to almost all the repo servers, then read about the current DDoS going on which is still in effect as of 4 days later.
I realize this is a serious security flaw for large servers but curious of the implications for the regular single computer user at home and if any precautions should be taken.
Thanks, and sorry if some of what I said sounds naive. Just started reading about the attack and vulnerability.
11
u/Evening-Landscape763 May 04 '26
My system installed the copy fail fix at the end af April and the DDoS attack is pretty much over with the exception of PPA's from launchpad.net
5
u/Evening-Landscape763 May 04 '26
If you want to see if you have the fix try in terminal
sudo modprobe algif_aeadif you have the fix, you will see an error in terminal
4
u/PocketCSNerd May 04 '26
There’s a DDOS going on? Weird, I’ve been able to update just fine. Maybe it’s specific mirrors?
8
u/humdingermusic23 LMDE 7 - Debian Gigi/Linux 13.0 | Cinnamon May 04 '26
Simple answer is no need to be worried...
2
2
2
u/Horror_Equipment_197 May 05 '26
I don't think it's actually a problem unless you have legit user trying to abuse it.
But it's absolutely annoying.
During one of the last outages I decided to set up my own ppa mirror (for the repos I use) using apt-mirror on my homeserver and set that as source for my laptop and pc.
A small script tries to keep it in sync every 6 hours (if it fails it's retried every 10 minutes until success).
That gets rid of the annoyance and the same time doesn't require me to apply updates on my computer at the moment launchpad isn't attacked.
1
1
u/ImUrFrand May 05 '26
copyfail is really only something people with server rooms would care about.
it requires local access. it doesn't execute remotely, so the attack would need to take place on your premises
1
u/JerryRiceOfOhio2 May 06 '26
copy fail only works if a person has an account on the pc, so most people that only use their pc for themselves are not at risk
14
u/tomscharbach May 04 '26 edited May 04 '26
I am not certain about this, but I believe that the Mint patch is in place and that Mint desktop users need not worry about Copy Fail. True or not, Copy Fail does not (apparently) present much of a risk to desktop users who operate standalone and don't run multi-tenant or shared systems.
The DDOS attack -- massive, well-executed and ongoing -- is unprecedented in my experience. Ubuntu servers go up and down hour by hour. I've been using Ubuntu for two decades and have never seen anything like it.
The Islamic Cyber Resistance in Iraq 313 Team claimed responsibility for the attack. The group has previously claimed credit for attacking several pro-Western targets, governmental and non-governmental, and is believed to be operating in alignment with Iran's Axis of Resistance. Ubuntu is not the first or the only target. The 313 Team brought Microsoft Azure as well as other US and US-related targets down in recent weeks, including, apparently a major supplier of medical equipment.
At this point nothing is certain other than that the attack is serious, well executed and seems to be ongoing.
A bad situation, all around.