rio128128 Exploits and Proofs of Concept

Showing 4 PoCs on this page

GitHub

rio128128/copy-fail-CVE-2026-31431

Repository PoC0Created 2026-04-30ExploitCVE-2026-314312 files

9.8 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Technical assessment

A 732-byte Python script that exploits CVE-2026-31431 in the Linux kernel's AF_ALG/authencesn to perform a controlled 4-byte write into the page cache of a setuid binary (payload withheld), achieving local privilege escalation to root.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README describing CVE-2026-31431 and a Python exploit script. The script uses standard library calls to interact with AF_ALG sockets and splice to corrupt the page cache of payload withheld, then executes the modified binary. No concealed backdoor, unrelated payload, or operator-directed harm beyond the described exploit is observed.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesPython

Target softwareLinux kernelalgif_aeadauthencesn

Attack typeslocal privilege escalationarbitrary write

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact copy_fail_exp.py contains executable Python code that performs the full exploit chain: socket setup, crafted sendmsg, splice of target file, recv to trigger the vulnerability, and execution of the corrupted binary to gain root. The README.md describes it as an exploit and confirms it was used to root multiple distributions.

copy_fail_exp.py:1-10README.md:99-128

Requirements

Unprivileged local user accessREADME.md:5
Python 3.10+ with os.splice supportREADME.md:30
Target setuid binary (payload withheld) must be readableREADME.md:101

Observed behavior

Opens an AF_ALG socket and binds to authencesn(hmac(sha256),cbc(aes))copy_fail_exp.py:5
Sends crafted AAD containing shellcode bytes via sendmsg()copy_fail_exp.py:5
Uses splice() to feed page cache pages of payload withheld into the AF_ALG socketcopy_fail_exp.py:5
Triggers recv() to cause authencesn to write shellcode bytes into the page cachecopy_fail_exp.py:6-7
Executes the corrupted payload withheld to gain root shellcopy_fail_exp.py:10

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Target: Payload withheldThe script targets a setuid-root binary for privilege escalation, consistent with the described vulnerability.copy_fail_exp.py:8
Payload: Payload withheldThe script decompresses and writes this payload into the target binary's page cache to achieve code execution.copy_fail_exp.py:8-9

Review boundaries

What the analysis did not establish

The compressed payload in copy_fail_exp.py is opaque; its exact behavior is not analyzed beyond its role in the described exploit.
Only the two text files in the repository were reviewed; no other artifacts exist in the provided evidence.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub