CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The bug chain:

1. Caller binds AF_ALG socket to:
      authencesn(hmac(sha256),cbc(aes))

2. Caller sends a decryption request via sendmsg() with specific flags

3. Caller uses splice() to feed PAGE CACHE PAGES from an open file
   descriptor directly into the socket's scatterlist

4. The authencesn template, during ESN header processing, uses the
   OUTPUT BUFFER as scratch space — writing 4 bytes past the
   expected output boundary

5. Because the scatterlist contains page cache pages (not private
   copies), this scratch write lands DIRECTLY IN THE PAGE CACHE

6. Page cache is shared kernel-wide — all processes reading the
   same file now see the modified bytes

Key insight: splice() is zero-copy — it hands page cache references
to the socket. The in-place "optimization" then writes INTO those
pages. No dirty bit is set because the write goes through the crypto
engine, not the normal write path.

[1] Open /usr/bin/su (or any setuid-root binary) for reading
    ↓
[2] Map a copy to find target instruction bytes
    (e.g., UID check, execve path, security gate)
    ↓
[3] Compute exact page cache offset of target bytes
    ↓
[4] Set up AF_ALG socket → authencesn(hmac(sha256),cbc(aes))
    ↓
[5] splice() the target binary's page cache into the socket
    ↓
[6] Trigger decryption → authencesn scratch write patches
    the target bytes in page cache (4 bytes per iteration)
    ↓
[7] Repeat for each 4-byte patch needed
    ↓
[8] Execute /usr/bin/su → runs root-owned setuid binary
    but now with attacker-controlled code in page cache
    ↓
[9] Root shell

# Check if vulnerable
uname -r
cat /proc/crypto | grep -A10 "authencesn"
lsmod | grep algif_aead

# Verify setuid target exists
ls -la /usr/bin/su /usr/bin/sudo /usr/bin/passwd

# Default: targets /usr/bin/su
python3 copy_fail_exp.py

# Custom target
python3 copy_fail_exp.py /usr/bin/passwd

Attacker in container → patches /usr/bin/su in HOST page cache
Host user runs su → executes attacker code as root on host

chmod +x detection/check_vulnerable.sh
sudo ./detection/check_vulnerable.sh

# Install YARA
apt-get install yara   # Debian/Ubuntu
dnf install yara       # RHEL/Fedora
apk add yara           # Alpine

# Scan running process executables
sudo yara -r detection/yara/cve_2026_31431_enhanced.yar /proc/*/exe 2>/dev/null

# Scan common dropper locations
sudo yara -r detection/yara/cve_2026_31431_enhanced.yar /home /tmp /var/tmp /dev/shm

# Scan uploaded files / quarantine
yara detection/yara/cve_2026_31431_base.yar <suspect_file>

# Detect AF_ALG socket creation (family 38 = 0x26)
-a always,exit -F arch=b64 -S socket -F a0=38 -k cve_2026_31431_afalg

# Detect splice() calls — used to feed page cache into the socket
-a always,exit -F arch=b64 -S splice -k cve_2026_31431_splice

# Monitor algif_aead module loading
-a always,exit -F arch=b64 -S init_module -S finit_module -k cve_2026_31431_modload

# Detect setuid binary execution by non-root users
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -k cve_2026_31431_suid_exec

augenrules --load && service auditd restart

# Look for AF_ALG socket creation
ausearch -k cve_2026_31431_afalg --start today

# Correlate: same PID doing AF_ALG socket + splice
ausearch -k cve_2026_31431_afalg -k cve_2026_31431_splice --start today

- rule: CVE-2026-31431 AF_ALG Socket Creation
  desc: Detects unprivileged process creating AF_ALG socket (family 38) — required step for Copy Fail exploit
  condition: >
    syscall.type = socket and
    evt.arg.domain = 38 and
    not user.uid = 0 and
    not proc.name in (known_crypto_daemons)
  output: >
    CVE-2026-31431 exploitation attempt - AF_ALG socket (user=%user.name
    uid=%user.uid pid=%proc.pid cmd=%proc.cmdline)
  priority: CRITICAL
  tags: [cve-2026-31431, lpe, kernel, crypto]

- list: known_crypto_daemons
  items: [strongswan, charon, pluto, openssl]

- rule: CVE-2026-31431 Splice After AF_ALG
  desc: Detects splice() syscall shortly after AF_ALG socket creation — exploitation sequence
  condition: >
    syscall.type = splice and
    not user.uid = 0 and
    evt.elapsed < 5000000000
  output: >
    CVE-2026-31431 splice after AF_ALG socket (user=%user.name pid=%proc.pid)
  priority: CRITICAL
  tags: [cve-2026-31431, lpe]

#!/bin/bash
# Compare in-memory binary against on-disk binary
SETUID_BINS=("/usr/bin/su" "/usr/bin/sudo" "/usr/bin/passwd")

for binary in "${SETUID_BINS[@]}"; do
    [[ -f "$binary" ]] || continue
    LIVE_HASH=$(sha256sum "$binary" | awk '{print $1}')
    echo 3 | sudo tee /proc/sys/vm/drop_caches > /dev/null  # flush page cache
    DISK_HASH=$(sha256sum "$binary" | awk '{print $1}')
    if [[ "$LIVE_HASH" != "$DISK_HASH" ]]; then
        echo "CRITICAL: Page cache tampering detected on $binary"
        echo "  Pre-flush:  $LIVE_HASH"
        echo "  Post-flush: $DISK_HASH"
    else
        echo "OK: $binary page cache matches disk"
    fi
done

index=linux_audit sourcetype=auditd action=SYSCALL syscall=socket a0="0x26"
| join pid [
    search index=linux_audit sourcetype=auditd action=SYSCALL syscall=splice
  ]
| where (_time - join_time) < 30
| table _time host user pid cmd a0
| eval severity="CRITICAL"

event.action: "SYSCALL" AND 
process.args: "socket" AND 
auditd.data.a0: "0x26" AND
NOT user.id: "0"

Syslog
| where Facility == "kern" or ProcessName == "audit"
| where SyslogMessage contains "socket" and SyslogMessage contains "a0=0x26"
| extend UserName = extract("uid=([0-9]+)", 1, SyslogMessage)
| where UserName != "0"
| project TimeGenerated, Computer, UserName, SyslogMessage
| order by TimeGenerated desc

chmod +x patch/patch.sh
sudo ./patch/patch.sh

# Blacklist the module permanently
echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif-aead.conf
echo "install authencesn /bin/false" | sudo tee -a /etc/modprobe.d/disable-algif-aead.conf

# Unload if currently loaded
sudo rmmod algif_aead 2>/dev/null || echo "Not loaded — mitigation active after config"

# Verify
lsmod | grep algif_aead && echo "WARNING: still loaded — reboot needed" || echo "OK: not loaded"

# Check all node kernel versions
kubectl get nodes -o wide

# Drain → update node kernel → uncordon (one node at a time)
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data
# SSH into node and run kernel update
kubectl uncordon <node-name>

# Re-run detection script
sudo ./detection/check_vulnerable.sh

# Quick manual verification
uname -r                          # confirm new kernel version
lsmod | grep algif_aead           # should be empty
cat /proc/crypto | grep authencesn  # should return nothing (or still listed but module blacklisted)

cd lab/
docker compose up -d
docker exec -it cve-2026-31431-lab /bin/sh

# Inside container:
/cve-2026-31431/detection/check_vulnerable.sh

cve-2026-31431/
├── README.md                          ← This document
├── exploit/
│   ├── README.md                      ← Technical exploit breakdown
│   └── poc.py                         ← Public PoC (theori-io, for reference)
├── detection/
│   ├── README.md                      ← Detection guide
│   ├── check_vulnerable.sh            ← Vulnerability & IoC detection script
│   └── yara/
│       ├── cve_2026_31431_base.yar    ← Detects known public PoC
│       └── cve_2026_31431_enhanced.yar ← Detects obfuscated/compiled variants
├── patch/
│   ├── README.md                      ← Remediation guide
│   └── patch.sh                       ← Automated patch/mitigation script
└── lab/
    ├── README.md                      ← Lab setup guide
    ├── Dockerfile                     ← Alpine-based lab container
    └── docker-compose.yml             ← Lab orchestration