# 克隆或下载脚本，然后：
python3 cve-2026-31431-detect.py

# 示例：若主机易受攻击则使 CI 步骤失败
python3 cve-2026-31431-detect.py
rc=$?
if [ $rc -eq 1 ]; then
  echo "VULNERABLE — block deployment"
elif [ $rc -ne 0 ]; then
  echo "ERROR — script failed to complete (exit $rc)"
fi

CVE-2026-31431 'Copy Fail' — Vulnerability Detection
authencesn page cache corruption / local privilege escalation
Running as uid=1001, euid=1001

=== Kernel Version ===
  [VULNERABLE] Kernel version
          Reason : Kernel is in the vulnerable range (4.10 – 6.14)
          Detail : Release: 6.12.0-124.45.1.el10_1 — patch status must be confirmed

=== CONFIG_CRYPTO_AUTHENC (Kernel Config) ===
  [VULNERABLE] CONFIG_CRYPTO_AUTHENC
          Reason : Built as module (=m): auto-loads on AF_ALG bind(); modprobe blacklist is the correct mitigation

=== CONFIG_CRYPTO_USER_API_AEAD (Kernel Config) ===
  [VULNERABLE] CONFIG_CRYPTO_USER_API_AEAD
          Reason : AF_ALG AEAD interface is a loadable module — unprivileged users can access the crypto subsystem via AF_ALG sockets

...

  SYSTEM IS LIKELY VULNERABLE TO CVE-2026-31431

  Recommended actions:
    1. Apply your distribution's kernel update for CVE-2026-31431
    2. Until patched, blacklist the module:
         echo 'install algif_aead /bin/false' > /etc/modprobe.d/disable-algif-aead.conf
         rmmod algif_aead 2>/dev/null
       NOTE: this is ONLY effective when CONFIG_CRYPTO_AUTHENC=m (module).
       If CONFIG_CRYPTO_AUTHENC=y (built-in), patching is the only fix.

# 基本运行
bash cve-2026-31431-detect.sh

# JSON 输出——适用于 SIEM 摄取、Ansible facts、日志聚合
bash cve-2026-31431-detect.sh --json > scan-results.json

# 静默模式——仅打印摘要（适用于 CI 日志）
bash cve-2026-31431-detect.sh --quiet

# 禁用 ANSI 颜色（适用于日志文件）
bash cve-2026-31431-detect.sh --no-colour

echo 'install algif_aead /bin/false' > /etc/modprobe.d/disable-algif-aead.conf
rmmod algif_aead 2>/dev/null

# GitHub Actions
# 当脚本以退出码1退出时，该步骤将自然失败并阻止流水线。
# 无需额外配置——非零退出码默认使步骤失败。
- name: Check CVE-2026-31431
  run: |
    python3 cve-2026-31431-detect.py
    rc=$?
    if [ $rc -eq 1 ]; then
      echo "VULNERABLE — pipeline blocked"
      exit 1
    elif [ $rc -ne 0 ]; then
      echo "ERROR — detection script failed to complete (exit $rc)"
      exit $rc
    fi

# Ansible
# 使用 playbook_dir 确保脚本路径正确解析。
# failed_when 检查任何非零退出（漏洞或脚本错误）。
- name: Check for CVE-2026-31431
  script: "{{ playbook_dir }}/cve-2026-31431-detect.py"
  register: cve_check
  failed_when: cve_check.rc != 0

# Nagios / 监控检查（shell 脚本——原生支持退出码）
bash cve-2026-31431-detect.sh --quiet
# exit 0 = OK, exit 1 = CRITICAL (vulnerable)

# 用于 SIEM / 日志聚合的 JSON 输出（shell 脚本）
bash cve-2026-31431-detect.sh --json --quiet > /var/log/cve-2026-31431-$(hostname)-$(date +%Y%m%d).json