Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
mks-copy-fail-mitigation — DaemonSet с реализацией временной меры для митигации уязвимости Copy Fail (CVE-2026-31431) | Kitploit
Tools/GitHubGitHub/selectel/mks-copy-fail-mitigation
Cloud Infrastructure SecurityPrivilege EscalationContainer SecurityVulnerability AnalysisCloud SecurityMisconfiguration
GitHubselectel/mks-copy-fail-mitigation

mks-copy-fail-mitigation

DaemonSet с реализацией временной меры для митигации уязвимости Copy Fail (CVE-2026-31431)

View Repository
23 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Copy Fail Mitigation DaemonSets

DaemonSets for fixing vulnerabilities of the Copy Fail family on all worker nodes of MKS clusters.

Contents

  • CVE-2026-31431 (Copy Fail)
  • CVE-2026-43284, CVE-2026-43500, CopyFail2 (Dirty Flag)

CVE-2026-31431 (Copy Fail)

Vulnerability Description

CVE ID: CVE-2026-31431

CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2026-31431

Attack Vector and Severity Level according to CVSS v.3.1:

Score: 7.8 HIGH

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Brief Description:

Copy Fail (CVE-2026-31431) is a logical vulnerability in the cryptographic API subsystem of the Linux kernel that allows a regular system user to gain superuser (root) privileges. The PoC works on all major Linux distributions released since 2017 and up to the patch release.

Features:

  • can be used as a container escape primitive to the host due to the use of a page cache shared across the entire host
  • does not require remote access — exploitation is only possible if a local unprivileged account exists
  • uses the kernel crypto API (AF_ALG), which is enabled by default in configurations of almost all popular distributions

    • What This DaemonSet Does

    The DaemonSet runs a container on each worker node of the cluster:

    1. Tests the availability of the AF_ALG AEAD interface
    2. Creates the configuration /etc/modprobe.d/disable-algif.conf
    3. Executes rmmod algif_aead if the module is loaded
    4. Checks that the vulnerability is fixed by re-running the check from step 1

    Usage

    1. Download the DaemonSet

    root@kitploit:~
    wget https://raw.githubusercontent.com/selectel/mks-copy-fail-mitigation/refs/heads/main/copy-fail-mitigation-daemonset.yaml

    Or clone the repository:

    root@kitploit:~
    git clone https://github.com/selectel/mks-copy-fail-mitigation.git
cd mks-copy-fail-mitigation

    2. Apply the DaemonSet

    root@kitploit:~
    kubectl apply -f copy-fail-mitigation-daemonset.yaml

    3. Check Execution Status

    root@kitploit:~
    # Check DaemonSet status
kubectl get daemonset -n kube-system cve-2026-31431-mitigation

# Get list of pods
kubectl -n kube-system get pods -l app=cve-2026-31431-mitigation -o wide

    4. View Execution Logs

    root@kitploit:~
    # Logs of initContainer
kubectl -n kube-system logs -l app=cve-2026-31431-mitigation -c mitigation

    5. To Delete the DaemonSet

    root@kitploit:~
    kubectl delete -f copy-fail-mitigation-daemonset.yaml

    CVE-2026-43284, CVE-2026-43500, CopyFail2 (Dirty Flag)

    CVE ID: CVE-2026-43284, CVE-2026-43500

    CopyFail2: without a separate CVE ID

    CVE Links:

    • https://nvd.nist.gov/vuln/detail/CVE-2026-43284
    • https://nvd.nist.gov/vuln/detail/CVE-2026-43500

    Brief Description:

    Dirty Flag / CopyFail2 — vulnerabilities in the IPsec subsystem of the Linux kernel (modules esp4, esp6 and rxrpc), allowing a local unprivileged user to gain superuser (root) privileges.

    Features:

    • can be used as a container escape primitive to the host
    • use the kernel modules esp4 (IPsec IPv4), esp6 (IPsec IPv6) and rxrpc (RxRPC protocol), which are enabled by default in most distributions

    What This DaemonSet Does

    The DaemonSet runs a container on each worker node of the cluster:

    1. Checks via lsmod whether the modules esp4, esp6, rxrpc are loaded
    2. Creates configuration /etc/modprobe.d/disable-esp-rxrpc.conf with rules install esp4/esp6/rxrpc /bin/false
    3. Executes rmmod for each module if it is loaded
    4. Checks that the modules are no longer loaded via a repeated lsmod

    Usage

    1. Download the DaemonSet

    root@kitploit:~
    wget https://raw.githubusercontent.com/selectel/mks-copy-fail-mitigation/refs/heads/main/dirty-flag-copyfail2-mitigation-daemonset.yaml

    Or clone the repository:

    root@kitploit:~
    git clone https://github.com/selectel/mks-copy-fail-mitigation.git
cd mks-copy-fail-mitigation

    2. Apply the DaemonSet

    root@kitploit:~
    kubectl apply -f dirty-flag-copyfail2-mitigation-daemonset.yaml

    3. Check Execution Status

    root@kitploit:~
    # Check DaemonSet status
kubectl get daemonset -n kube-system dirty-flag-copyfail2-mitigation

# Get list of pods
kubectl -n kube-system get pods -l app=dirty-flag-copyfail2-mitigation -o wide

    4. View Execution Logs

    root@kitploit:~
    # Logs of initContainer
kubectl -n kube-system logs -l app=dirty-flag-copyfail2-mitigation -c mitigation

    5. To Delete the DaemonSet

    root@kitploit:~
    kubectl delete -f dirty-flag-copyfail2-mitigation-daemonset.yaml
    Download Tool