Smarttfoxx/copyfail

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A C exploit for CVE-2026-31431 that achieves local privilege escalation by corrupting the page cache of /usr/bin/su via AF_ALG AEAD operations, then executing the modified binary to gain root.

Backdoor review

No backdoor observed in reviewed code

The repository contains a single C exploit (exploit.c) and a README.md describing a local privilege escalation PoC for CVE-2026-31431. The exploit uses AF_ALG socket operations to corrupt the page cache of /usr/bin/su and then executes it to gain root. All code is directly aligned with the described vulnerability exploitation technique; no hidden, deceptive, or unrelated harmful behavior (such as credential theft, persistence, or remote access) is present. The shellcode payload performs only setuid(0) and execve("/bin/sh").

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesC
Target softwareLinux kernel (crypto/algif_aead)
Attack typeslocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains complete, compilable C source code that actively exploits CVE-2026-31431 to overwrite a setuid binary's page cache with shellcode and then execute it to gain root privileges. The README explicitly describes it as a 'Local privilege escalation exploit' and provides usage instructions showing a root shell.

README.md:3exploit.c:163-264

Requirements

  • Local unprivileged user access to a vulnerable Linux kernel with AF_ALG support and a setuid-root /usr/bin/su binary.exploit.c:163-172

Observed behavior

  • Opens /usr/bin/su, parses its ELF headers to resolve the entry point virtual address to a file offset.exploit.c:168-193
  • Creates an AF_ALG socket and binds to the 'authencesn(hmac(sha256),cbc(aes))' AEAD algorithm with a zero key.exploit.c:195-227
  • For each 4-byte chunk of the shellcode, sends AAD containing the shellcode bytes via sendmsg with MSG_MORE, splices 32 bytes from the target file's page cache as the authentication tag, and triggers decryption via recv to write controlled bytes into the page cache.exploit.c:88-161exploit.c:241-255
  • Executes the corrupted /usr/bin/su binary, which runs the injected shellcode (setuid(0); execve("/bin/sh")) to spawn a root shell.exploit.c:261-264exploit.c:52-67
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Technique
AF_ALG page cache corruption via splice/recv to overwrite /usr/bin/su entry point with shellcodeThe exploit uses the CVE-2026-31431 vulnerability to escalate privileges locally. This is the stated purpose of the PoC.exploit.c:88-161exploit.c:163-265README.md:8-14
Shellcode
setuid(0); execve("/bin/sh", NULL, NULL)The shellcode embedded in the exploit performs only privilege escalation to a root shell, consistent with the PoC's stated goal.exploit.c:52-67README.md:18-32
Target Binary
/usr/bin/suThe exploit targets a setuid-root binary to achieve privilege escalation, which is the documented attack vector for this CVE.exploit.c:42exploit.c:168exploit.c:262
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied source files; no binary, build artifacts, or runtime output were provided or analyzed.
  • The exploit targets a specific kernel vulnerability and setuid binary; it may not work on patched kernels or systems without /usr/bin/su.
  • Only the two text files (README.md and exploit.c) were reviewed; no binary artifacts were present or analyzed.
  • The review does not assess whether the exploit actually works or is safe to execute; it only evaluates the presence of backdoor or deceptive behavior in the supplied code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1