rio128128/copy-fail-CVE-2026-31431

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A 732-byte Python script that exploits CVE-2026-31431 in the Linux kernel's AF_ALG/authencesn to perform a controlled 4-byte write into the page cache of a setuid binary (/usr/bin/su), achieving local privilege escalation to root.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README describing CVE-2026-31431 and a Python exploit script. The script uses standard library calls to interact with AF_ALG sockets and splice to corrupt the page cache of /usr/bin/su, then executes the modified binary. No concealed backdoor, unrelated payload, or operator-directed harm beyond the described exploit is observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareLinux kernelalgif_aeadauthencesn
Attack typeslocal privilege escalationarbitrary write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact copy_fail_exp.py contains executable Python code that performs the full exploit chain: socket setup, crafted sendmsg, splice of target file, recv to trigger the vulnerability, and execution of the corrupted binary to gain root. The README.md describes it as an exploit and confirms it was used to root multiple distributions.

copy_fail_exp.py:1-10README.md:99-128

Requirements

  • Unprivileged local user accessREADME.md:5
  • Python 3.10+ with os.splice supportREADME.md:30
  • Target setuid binary (/usr/bin/su) must be readableREADME.md:101

Observed behavior

  • Opens an AF_ALG socket and binds to authencesn(hmac(sha256),cbc(aes))copy_fail_exp.py:5
  • Sends crafted AAD containing shellcode bytes via sendmsg()copy_fail_exp.py:5
  • Uses splice() to feed page cache pages of /usr/bin/su into the AF_ALG socketcopy_fail_exp.py:5
  • Triggers recv() to cause authencesn to write shellcode bytes into the page cachecopy_fail_exp.py:6-7
  • Executes the corrupted /usr/bin/su to gain root shellcopy_fail_exp.py:10
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Target
/usr/bin/suThe script targets a setuid-root binary for privilege escalation, consistent with the described vulnerability.copy_fail_exp.py:8
Payload
zlib-compressed shellcode embedded in the scriptThe script decompresses and writes this payload into the target binary's page cache to achieve code execution.copy_fail_exp.py:8-9
Review boundaries

What the analysis did not establish

  • The compressed payload in copy_fail_exp.py is opaque; its exact behavior is not analyzed beyond its role in the described exploit.
  • Only the two text files in the repository were reviewed; no other artifacts exist in the provided evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1