This message was deleted.
# harvestera
adamant-kite-43734
04/30/2026, 11:21 AMThis message was deleted.
b
bland-article-62755
04/30/2026, 2:47 PM@plain-ambulance-12322 I don't think Harvester loads any of the required modules for the hack for Copy Fail to work here.
Copy code
dh1:~ # cat /etc/os-release
NAME="SL-Micro"
VERSION="6.1"
VERSION_ID="6.1"
PRETTY_NAME="Harvester v1.7.1"
ID="sl-micro"
ID_LIKE="suse sle-micro opensuse-microos microos"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:suse:sl-micro:6.1"
HOME_URL="<https://www.suse.com/products/micro/>"
DOCUMENTATION_URL="<https://documentation.suse.com/sl-micro/6.1/>"
LOGO="distributor-logo"
IMAGE_REPO="<http://registry.suse.com/suse/sl-micro/6.1/base-os-container|registry.suse.com/suse/sl-micro/6.1/base-os-container>"
IMAGE_TAG="2.2.1-5.74"
IMAGE="<http://registry.suse.com/suse/sl-micro/6.1/base-os-container:2.2.1-5.74|registry.suse.com/suse/sl-micro/6.1/base-os-container:2.2.1-5.74>"
TIMESTAMP=20260203151042
GRUB_ENTRY_NAME="SUSE Linux Micro"
VARIANT="Harvester"
VARIANT_ID="Harvester-v1.7-20260209"
GRUB_ENTRY_NAME="Harvester v1.7.1"
dh1:~ # uname -r
6.4.0-36-default
dh1:~ # lsmod | grep -i alg
i2c_algo_bit 20480 1 mgag200
xfrm_algo 16384 1 ixgbebland-article-62755
04/30/2026, 2:48 PMSure you can break out of a container, but I think to apply the hack means you've already been pwnd.
bland-article-62755
04/30/2026, 2:50 PMDoesn't seem possible from #C028DVCAYLD either, but lots of people are running affected distros are running #C01PHNP149L
p
plain-ambulance-12322
04/30/2026, 2:50 PMWe're running a shared service, so container breakout is still very bad for us 🙂
b
bland-article-62755
04/30/2026, 2:51 PMSo just a tuesday?
bland-article-62755
04/30/2026, 2:52 PMI mean you'd have to leverage some other container breakout to then escalate the copy fail against the host.
p
plain-ambulance-12322
04/30/2026, 2:55 PMhttps://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Kubernetes-PoC
There's already a PoC host exec leveraging kube-proxy
b
bland-article-62755
04/30/2026, 2:56 PMBut your host would have to have the require module loaded on the host.
bland-article-62755
04/30/2026, 2:56 PMIt's not in Harvester/Elemental.
bland-article-62755
04/30/2026, 2:56 PMThe only way to do that would be to already own root on the box.
bland-article-62755
04/30/2026, 2:58 PMAlso from the Migitation you listed here:
Use read-only root filesystems for kube-proxy (does not fully mitigate, but limits payload capabilities).
bland-article-62755
04/30/2026, 2:59 PMI think they should still patch the Harvester releases, but without patches, Harvester is fairly mitigated.
c
creamy-pencil-82913
04/30/2026, 6:25 PM32 Views