AF_ALG su memory‑patch exploit (research)

A compact Python script that exploits an AF_ALG‑related kernel vulnerability to patch the su binary in memory and escalate privileges. This is provided for educational and research purposes only.

⚠️ Do not use this on any system you do not own or without explicit authorization. Misuse may violate laws and security policies.

Purpose

• Demonstrate how AF_ALG socket options and splice can be abused to modify executable memory in specific kernel versions.
• Serve as a minimal example to study kernel‑exploit primitives and memory‑patching techniques.

How it works (high level)

• Open /usr/bin/su and hold it in memory.
• Use an AF_ALG socket with carefully crafted setsockopt and sendmsg calls to force the kernel into copying attacker‑controlled bytes into the mapped pages of the su binary.
• Patch a small region of the su binary using repeated splice calls.
• Execute su to obtain a shell at the patched entry point.

This is not a generic “root tool” and only works on specific vulnerable kernel configurations.

Requirements

• A Linux system with the vulnerable kernel interface (AF_ALG + specific setsockopt behaviour).
• /usr/bin/su must be present and readable.
• AF_ALG and the crypto algorithm authencesn(hmac(sha256),cbc(aes)) must be available.

Usage (for research only)

git clone https://github.com/povzayd/CVE-2026-31431.git
python3 exploit.py

You must run this on a controlled lab or test‑only machine you own.