Local Privilege Escalation Vulnerability in Linux Kernel (Copy Fail)

Summary
A local privilege escalation vulnerability, commonly known as "Copy Fail", has been reported to affect the Linux kernel. If exploited, this vulnerability could allow an authenticated, non-administrator user with code execution capabilities to obtain elevated system privileges.

This vulnerability specifically affects systems that meet both of the following criteria:

1. Architecture: ARM64 .
2. Kernel Version: Linux Kernel 5.10.

QNAP is currently investigating the issue and developing security updates. This advisory will be updated as soon as fixes are available.

Affected Products
The following operating system versions are affected:

• QTS on specific QNAP ARM64 NAS models running Kernel 5.10 

To verify your NAS architecture and kernel version, please log in to QTS or check the technical specifications for your model at: https://www.qnap.com/go/release-notes/kernel

Products Not Affected

The following products and configurations are not impacted by this vulnerability:

• All QNAP x86-based NAS 
• All QuTS hero NAS models 
• QNAP ARM-based NAS running QTS 4.x (these utilize older kernel versions).
• QNAP ARM-based NAS running kernel versions other than 5.10.

Recommendation

The security vulnerability has been successfully patched. Please download and install the latest firmware to ensure your device remains secure.