CVE-2026-31431-mitigation-suite

Kernel-runtime defense framework for AF_ALG vulnerabilities, featuring eBPF socket tracing, Ansible hardening, and a crypto auditor for drift detection.

• Almost no userspace requires it. OpenSSL, GnuTLS, libsodium and systemd-cryptsetup all use other paths by default.
• Adversaries are interested in it. It is a recurring pivot in privilege-escalation chains (CVE-2019-8912, CVE-2017-13215, and others) precisely because it is reachable from unprivileged containers when user namespaces are available.
• It is invisible to most EDRs. Endpoint tools that hook connect(), bind(), or DNS see nothing — AF_ALG traffic never leaves the kernel.

This framework treats every AF_ALG socket creation as a high-signal event and reduces the surface that makes those events exploitable.

Threat model and Zero Trust mapping

Repository layout

Components

1. Runtime observability — eBPF tracer

ebpf/af_alg_tracer.py attaches a kprobe to security_socket_create. The probe filters on family == 38 at the BPF program level so the verifier prunes unrelated socket creations and the per-event overhead stays in nanoseconds. It emits one JSON record per attempt:

Pipe stdout into Vector, Fluent Bit, or journald (via systemd-cat). A comm-name allowlist (/etc/af-alg-defense/allow.list) suppresses known-good consumers without losing the ability to detect deviations.

The kprobe target is the LSM hook, so events fire on intent — even attempts that would be denied by seccomp or RestrictAddressFamilies still produce a record. That is exactly what a SOC wants for behavioral baselining.

2. Configuration as Code — Ansible role + systemd drop-in

ansible/roles/af_alg_hardening/ applies two hardening layers:

Sysctl drop-in (/etc/sysctl.d/90-af-alg-defense.conf):

• kernel.unprivileged_userns_clone=0 — removes the userns pivot used by most AF_ALG escalation chains.
• user.max_user_namespaces=0 — distro-portable defence-in-depth.

Systemd drop-in (/etc/systemd/system/<unit>.d/50-af-alg-restrict.conf): Uses RestrictAddressFamilies as an allow-list (not deny-list). The unit is permitted AF_UNIX AF_INET AF_INET6 AF_NETLINK; any other family — AF_ALG included — fails with EAFNOSUPPORT because systemd enforces it through cgroup-attached BPF that the application cannot disable. The drop-in also strips CAP_SYS_ADMIN and applies ProtectKernel* to close the most common escalation paths.

Apply with:

For hosts without Ansible, drop the standalone file in place:

3. Kernel state auditor

auditor/crypto_auditor.py produces a JSON security-posture report by inspecting:

• /proc/crypto — every registered cipher / hash / aead, with FIPS flags and self-test status.
• /sys/module/ — loaded modules in the crypto subtree, with taint flags and parameter snapshots.
• /proc/sys/kernel/, /proc/sys/user/ — sysctls that gate AF_ALG attack paths.
• /sys/kernel/security/lockdown — kernel lockdown mode.

The report is keyed by stable finding IDs (FND-001 through FND-005 at present) so SIEM rules can suppress individual findings without dropping the whole document. Drift detection compares posture against a baseline:

The schema lives in schemas/audit_report.schema.json (Draft 2020-12) and is validated in CI on every push.

4. Continuous Integration

.github/workflows/ci.yml runs four jobs on every push and PR:

1. ShellCheck — every *.sh and shebang-bearing script.
2. Schema validation — metaschema-checks audit_report.schema.json, then runs the auditor live on the GH runner kernel and validates the resulting report. Fixtures in tests/fixtures/ are also checked.
3. Python lint (ruff check .).
4. Ansible lint on the role tree.

A failed schema check blocks merges, which prevents downstream SIEM parsers from breaking on a silently-renamed field.

Operational guidance for SOC

Detection rules to layer on top

• Any af_alg_socket_create event from a non-allowlisted comm — page on first occurrence, do not aggregate.
• New entry in crypto_modules between consecutive auditor runs on a host where module loading should be frozen.
• Any sysctl with hardened=false after a hardening playbook run — indicates manual tampering or drift from a parallel config system.
• lockdown field transitions from integrity/confidentiality to none — strong indicator of kernel-state tampering.

Rollout plan (recommended)

1. Deploy the eBPF tracer in monitor-only mode for two weeks. Use the resulting baseline to populate allow.list for known-good consumers (cryptsetup at boot is the usual one).
2. Run the auditor against a representative host fleet; capture the posture as the signed baseline.json.
3. Apply the Ansible role to a canary group with af_alg_systemd_services set to one low-risk unit. Watch for EAFNOSUPPORT errors in journald.
4. Expand the service list iteratively. systemd-analyze security <unit> should show the restriction is enforced.
5. Wire the auditor into a nightly cron with --fail-on-drift and route non-zero exits into the on-call queue.

What this framework does not do

• It does not unload af_alg if it's already in use. Module unloading is out of scope because legitimate boot-time consumers may still be running. Use modprobe.blacklist=af_alg on the kernel command line if you've confirmed nothing on the host needs it.
• It does not patch CVEs. Vendor kernel updates remain the primary control; this framework reduces the cost of a missed patch.
• It does not protect against root. A local root can disable any of these controls; the framework raises the bar to root, not past it.

Requirements

• Linux ≥ 4.18 (for the security_socket_create kprobe target).
• BCC ≥ 0.25 or libbpf ≥ 1.0, plus kernel headers matching uname -r.
• Python 3.10+ on managed hosts.
• Ansible 2.14+ on the control node.
• CAP_BPF (or root) to load the tracer; read access to /proc/crypto for the auditor (no privileges required to read it).

License

Apache-2.0. See LICENSE.