curl -fsSL https://raw.githubusercontent.com/codesource/copyfail-check/main/check_copyfail.sh | bash

curl -fsSL https://raw.githubusercontent.com/codesource/copyfail-check/main/check_copyfail.sh | sudo bash

curl -fsSL https://raw.githubusercontent.com/codesource/copyfail-check/main/check_copyfail.sh -o check_copyfail.sh
less check_copyfail.sh
bash check_copyfail.sh        # بدون صلاحيات الجذر
sudo bash check_copyfail.sh   # نتائج كاملة

for HOST in server1 server2 server3; do
  echo "=== $HOST ==="
  ssh "$HOST" "curl -fsSL https://raw.githubusercontent.com/codesource/copyfail-check/main/check_copyfail.sh | sudo bash"
done

- name: Check Copy Fail vulnerability
  hosts: all
  tasks:
    - name: Run check script
      script: check_copyfail.sh
      become: yes

pssh -h hosts.txt -i \
  "curl -fsSL https://raw.githubusercontent.com/codesource/copyfail-check/main/check_copyfail.sh | sudo bash"

============================================================
  Copy Fail CVE-2026-31431 – Vulnerability Check
============================================================

>>> Kernel Version
  [INFO]  Running kernel: 5.15.0-107-generic
  [WARN]  Kernel 5.15.0-107-generic is in the affected range (4.13 – 6.x).

>>> algif_aead Module Status
  [WARN]  algif_aead module is currently LOADED — system is exploitable.
  [WARN]  Module file found at: /lib/modules/5.15.0-107-generic/kernel/crypto/algif_aead.ko
  [WARN]  algif_aead is NOT blacklisted — it can be loaded on demand.

>>> Kernel Boot Parameter Mitigation
  [WARN]  initcall_blacklist=algif_aead_init is NOT set in boot parameters.

>>> AF_ALG Socket Reachability
  [WARN]  AF_ALG sockets are reachable by this user — exploit path is open.

>>> Mandatory Access Control (SELinux / AppArmor)
  [WARN]  Neither SELinux nor AppArmor tools detected — no MAC layer present.

>>> Distribution Patch Status
  [WARN]  Could not confirm CVE-2026-31431 is listed as fixed in running kernel's changelog.

============================================================
  SUMMARY
============================================================
  !! LIKELY VULNERABLE — No confirmed mitigation detected.

  Recommended actions (in order of preference):
  1. Apply your distro's kernel update as soon as available.
  2. Add to /etc/modprobe.d/copyfail.conf:
       blacklist algif_aead
       install algif_aead /bin/true
     Then run: sudo depmod -a && sudo update-initramfs -u
  3. Add to kernel boot parameters (grub):
       initcall_blacklist=algif_aead_init
  4. Immediately unload the module if loaded:
       sudo rmmod algif_aead
============================================================

# Debian / Ubuntu
sudo apt update && sudo apt upgrade linux-image-$(uname -r)

# RHEL / CentOS / Amazon Linux
sudo yum update kernel

# SUSE
sudo zypper update kernel-default

sudo tee /etc/modprobe.d/copyfail.conf << 'EOF'
blacklist algif_aead
install algif_aead /bin/true
EOF

sudo depmod -a

# Debian/Ubuntu
sudo update-initramfs -u

# RHEL/Fedora
sudo dracut -f

sudo rmmod algif_aead