Copy Fail (CVE-2026-31431) — Exploit Reproduction & Detection Lab

This repository documents the end-to-end reproduction, detection engineering, and incident response for CVE-2026-31431 ("Copy Fail"), a critical Linux kernel local privilege escalation vulnerability affecting kernels 4.14 through 7.0-rc.

Key Findings

• ✅ Successfully exploited CVE-2026-31431 on Kali Linux 2026.1 (kernel 6.18.12+kali-amd64)
• ✅ Deployed auditd syscall-level detection rules
• ✅ Created Sigma and YARA rules for cross-platform detection
• ✅ Developed a complete incident response playbook

Why This Matters

Copy Fail is a logic flaw, not a memory corruption. It is deterministic, affects virtually every Linux distribution shipped since 2017, and is completely fileless—traditional file integrity monitoring (AIDE, Tripwire) cannot see it. A working proof-of-concept fits in just 732 bytes of Python.

Lab Environment

Reproduction Steps

1. Verify Kali Version & Kernel

The lab starts by confirming the target is running a vulnerable kernel.

Kali Linux 2026.1 release and kernel details.

Output of uname -r showing vulnerable kernel 6.18.12+kali-amd64.

2. Check for Vulnerable Module

The exploit requires the algif_aead kernel module and the authencesn crypto template.

Module Loaded lsmod and modinfo confirm algif_aead is available; /proc/crypto shows the vulnerable authencesn template.

3. Python Version

The PoC uses os.splice, which needs Python 3.10+. We verify the interpreter.

Python Version Python 3.12 is installed and ready.

4. Vulnerability Checker (Non‑Destructive)

Before running the full exploit, a safe checker confirms the system is vulnerable.

The checker reports "potentially vulnerable", clearing the way for exploitation.

5. Create Unprivileged User

An unprivileged testuser account is created to simulate an attacker without special rights.

id shows UID 1001, confirming non‑root access.

6. Clone & Execute the Exploit

The official Theori PoC is cloned and executed from the unprivileged account.

Successfully cloned the exploit repository.

Exploit Execution The Python exploit overwrites the page cache and detonates the corrupted /usr/bin/su binary.

whoami and id output prove full root escalation.

7. Verify Fileless Nature (No Disk Modification)

The exploit only corrupts the in‑memory page cache. The on‑disk /usr/bin/su retains its original checksum.

SHA256 Match The sha256sum matches the original package hash even after exploitation, confirming no disk modification.

Detection Engineering

Copy Fail cannot be detected by file integrity monitoring. Instead, we focus on the syscall‑level primitives it uses.

auditd Rules

We deploy custom auditd rules that trigger on:

• AF_ALG socket creation (family 38)
• splice() syscall usage
• Read access to setuid binaries by unprivileged processes

All custom rules are active, verified with auditctl -l.

After running the exploit a second time, we see alerts for the exact syscalls used:

ausearch shows an AF_ALG socket creation event from the testuser process.

ausearch shows a splice() event from the same PID, a strong correlation.

Sigma Rule

A Sigma rule translates the auditd findings into a vendor‑neutral SIEM format.

Sigma YAML rule detecting AF_ALG socket creation and splice() calls.

YARA Rule

A YARA rule helps identify Copy Fail exploit code on disk.

YARA rule matching the authencesn string, socket constants, and splice() references found in PoCs.

Detection Coverage Summary

Incident Response Playbook

A full incident response report is available in reports/incident-copy-fail.md. It includes:

• Executive summary
• Indicators of compromise (IoCs)
• MITRE ATT&CK mapping (T1068, T1611)
• Containment and eradication steps
• Lessons learned regarding fileless attacks

Mitigation

Immediate mitigation (no reboot required):

echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif.conf
sudo rmmod algif_aead