Copy Fail: 732-Byte Python Script Roots Every Linux Since 2017

Level 1: The Universal Skeleton Key

Picture a giant office tower with guards, keycards, retina scanners, and randomly rotating door codes — millions spent on security. Then someone realizes that one little supply closet has a flaw: push the door a certain way and it quietly swings open into the CEO's office, every time, no timing, no tricks. And the same push works in every building this company has ever built. The funny-but-horrifying part of the card is its calm confidence: while everyone admired the fancy locks, the way in was a tiny, dumb, reliable little shove that had been sitting there for almost ten years.

Level 2: What These Words Mean

Decoding the jargon on the card:

• LPE / Local Privilege Escalation: you already have some access on a machine (a normal user account, or code running in a container) and you exploit a bug to become root — total control. The "local" means you're not breaking in from the internet; you're already inside and climbing.
• Kernel: the core of the OS that everything trusts. Bugs here are the worst kind because there's no higher authority to stop them.
• Race window: many exploits depend on hitting a split-second timing gap. Unreliable — you might need thousands of tries. This bug needs zero, which is why it's deterministic.
• Kernel-specific offset: normally exploits need the exact memory address of internal structures, which differ per kernel build. Needing none means one script works everywhere.
• Page cache: the kernel keeps recently-used file data in RAM for speed. Trick the kernel into writing to the wrong cached page and you've edited a file you shouldn't be able to.
• 732-byte script: the flex. Real exploits are often thousands of lines. Fitting a universal root exploit in 732 bytes of Python signals how clean (and how broken) the underlying flaw is.

If you're newer to this: imagine your apartment building's master key system. Most break-ins require picking a specific lock with the right tools at the right moment. This is more like discovering that every lock in every building of this brand, made since 2017, opens with the same bent paperclip — and nobody noticed for nine years.

Level 3: Branded Vulnerabilities and the Decade of Silence

This is styled as a polished vulnerability marketing page — bold wordmark ("Copy" in black, "Fail" in blue), confident sans-serif, the now-standard aesthetic that Heartbleed (2014) pioneered and every serious bug has copied since. The whole layout signals "this is a Real Capital-letter Vulnerability," and the original post's hedge — "Idk if it's meme or #news already" — is exactly the right reaction, because in modern security the line between the two has dissolved. A branded landing page is the disclosure now.

What makes this too real for security people isn't the cleverness; it's the "silently exploitable for nearly a decade." The bug shipped in 2017 and sat there. That's the recurring nightmare of systems security: the most dangerous vulnerabilities aren't novel exotic exploits, they're ancient logic mistakes in code so foundational nobody re-audits it. AF_ALG is a perfect host for this — it's a powerful, sharp-edged interface that exposes deep crypto internals to unprivileged code, has caused a string of CVEs over the years, and is disabled on hardened systems precisely because its attack surface vastly exceeds its everyday usefulness. The industry "got here" by valuing the convenience of userspace crypto offload over the blast radius of exposing kernel crypto state machines to anyone with a socket.

The systemic gut-punch is the asymmetry the meme celebrates: a decade of defensive engineering — randomization, canaries, mandatory access control, kernel lockdown — represents thousands of person-years of work, and a single integer-handling mistake in one obscure template renders all of it ornamental for this one path. Defense has to be right everywhere; offense needs one straight line.

Level 4: The Anatomy of a Straight-Line Root

The card brags about something that should make any kernel developer go quiet: a local privilege escalation that needs neither a race window nor a kernel-specific offset. To appreciate why that's terrifying, you have to understand what the disclosure text actually names — "One logic bug in authencesn, chained through AF_ALG and splice() into a 4-byte page-cache write." Each of those is a real, deliberate piece of the Linux kernel, and the joke is that they were never meant to touch each other.

AF_ALG is the kernel's userspace crypto socket API — it lets unprivileged programs say "encrypt this for me" using the kernel's own crypto implementations, via an ordinary socket. authencesn is a crypto template in that subsystem: authenticated encryption with associated data plus ESN (Extended Sequence Numbers), the kind of thing IPsec uses. It does internal buffer bookkeeping while assembling authentication data. If that bookkeeping has an off-by-something logic flaw — a length miscalculation, not a timing bug — then the kernel can be coaxed into writing slightly past where it should.

The genius and the horror is the chaining. splice() is a zero-copy plumbing syscall that moves bytes between file descriptors and pipes without round-tripping through userspace — it manipulates references to page-cache pages directly. The page cache is the kernel's in-memory mirror of file contents; a write into the wrong page-cache page is a write into a file you don't own, bypassing the permission checks that live at the syscall boundary, not at the page level. This is the same family of primitive that made Dirty Pipe so devastating a few years earlier: turn a tiny, controlled memory corruption into an arbitrary write to read-only/privileged file content, then overwrite something like a SUID binary or /etc/passwd and walk in as root.

Why is "no race, no offset" the scary part? Most kernel LPEs are probabilistic. A use-after-free race needs you to win a timing window — spray the heap, lose a hundred times, win once. A ROP-style exploit needs the exact address of a gadget, which KASLR (Kernel Address Space Layout Randomization) deliberately scrambles, so the exploit must be tailored per kernel build and often per boot. A straight-line logic flaw with a 4-byte deterministic write has none of that friction: every distribution, every kernel version since 2017, same 732-byte script, 100% reliability. As the disclosure card frames it, mitigations like KASLR, stack canaries, and lockdown LSMs all assume the attacker is fighting uncertainty. A deterministic logic bug simply doesn't fight uncertainty. It fits, as the joke goes, in a commit message.