Mitigation copy.fail

!!!hint The latest RHEL kernels do not include the vulnerability anymore, so please update to kernel-4.18.0-553.123.1.el8_10 (RHEL8) or kernel-5.14.0-611.54.1.el9_7 (RHEL9).
With this or newer kernels below mitigation is not required.

Following command can be used to disable the vulnerable feature in the current default kernel.

# Blacklist algif_aead_init
grubby --update-kernel="$(grubby --default-kernel)" --args="initcall_blacklist=algif_aead_init"

# Reboot the system
reboot now

# Verify the parameter
cat /proc/cmdline | grep initcall_blacklist

# double check loaded Kernel
uname -r


# [root@lx-term-02 ~]# cat /proc/cmdline | grep initcall_blacklist
# BOOT_IMAGE=(hd0,gpt2)/vmlinuz-5.14.0-611.42.1.el9_7.x86_64 root=/dev/mapper/vg_root-lv_root ro crashkernel=1G-2G:192M,2G-64G:256M,64G-:512M resume=UUID=4cfc7133-5787-42ec-bfbe-1fd3fbfb643f rd.lvm.lv=vg_root/lv_root initcall_blacklist=algif_aead_init
# [root@lx-term-02 ~]# uname -r
# 5.14.0-611.42.1.el9_7.x86_64i

The suggested mitigation by RedHat will affect all installed kernels and future kernels, but we assume that the next kernel update by RedHat will include the patch with the fix.

Source: https://access.redhat.com/solutions/7141931

1.3 KiB Raw Permalink Blame History

Mitigation copy.fail

1.3 KiB

Raw Permalink Blame History