Researchers from Xint have identified a vulnerability (CVE-2026-31431) in the Linux kernel that allows an unprivileged user to gain root access to the system. The issue has been given the code name Copy Fail. A prototype exploit is available. The vulnerability has been demonstrated in Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16, but it is noted that kernel packages from other distributions, including Debian, Arch, Fedora, Rocky, and Alma, are also affected, though they were not specifically tested.
The vulnerability is caused by a logical error in the Linux kernel's crypto API (AF_ALG), introduced during optimization in 2017 that removed unnecessary buffering by performing in-place operations on AEAD (Authenticated Encryption with Associated Data) block ciphering. The issue arose from careless use of the splice() function, which transfers data between file descriptors and pipes without copying, by passing references to elements in the page cache. After the optimization, when a file is sent to the AF_ALG socket for decryption, a direct reference to elements in the kernel's page cache containing the file's data was recorded in the scatterlist structure instead of a reference to a separate buffer.
Subsequently, during the AEAD decryption process, the linked data of the authentication tag was mixed with additional authenticated data (AAD) copied to the RX buffer and ciphertext, with the offset for writing to the authentication tag calculated relative to the copied data without adequate checks, allowing arbitrary areas in the page cache to be overwritten.
The vulnerability allows an attacker to overwrite 4 bytes at a chosen offset with each request, enabling them to alter the contents of any readable file in the system through a series of requests, after ensuring it is cached. Since during any read operations the contents are served primarily from the page cache, after replacing the information in the page cache, the kernel or process reading data from the file will receive not the actual data, but the substituted data, which can be exploited for code injection into executable files or loaded shared libraries.
To execute code with root privileges, it is sufficient to cause a change in the page cache for any executable file with the suid root flag.
The proposed exploit reads the executable file /usr/bin/su and modifies the content loaded into the page cache of that file to inject its own code. When the 'su' utility is subsequently run, it will load into memory not the original executable file from the storage, but a modified copy from the page cache.
The exploit is universal, does not require adaptation to distributions or kernel versions, and can be used with any distribution. Since container isolation uses a shared page cache for all containers, the vulnerability can be exploited to gain access to the host environment from the container (an exploit for bypassing isolation in Kubernetes is promised to be published later).
The vulnerability was identified using AI approximately after an hour of experiments analyzing the kernel's cryptographic subsystem code. The issue appears starting from Linux kernel 4.14, released in 2017, and has been fixed in kernels 6.18.22, 6.19.12, and 7.0. The status of vulnerabilities being fixed in distributions can be evaluated on these pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch,
Fedora, ROSA.
As a workaround for protection, the kernel module algif_aead, which is used in OpenSSL when explicitly enabling the afalg engine and in certain applications (the existence of such running applications can be checked with the command 'lsof | grep AF_ALG'):
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead
Source: opennet.ru
