# Copy Fail Assessment

## Short Answer

Based on the extracted rootfs, this kernel should be treated as vulnerable to Copy Fail / CVE-2026-31431 unless Stern or Raspberry Pi backported the fix into this exact `6.6.28-v8` kernel build out-of-band.

The available local evidence points vulnerable:

- Kernel module tree is `/lib/modules/6.6.28-v8`.
- `algif_aead.ko.xz` is present as a loadable module.
- `authencesn.ko.xz` is present as a loadable module.
- `modules.dep` wires both into the normal module dependency map.
- `algif_aead` module metadata describes it as `AEAD kernel crypto API user space interface`.
- `authencesn` module metadata describes it as `AEAD wrapper for IPsec with extended sequence numbers`.
- No `/etc/modprobe.d` mitigation was present in the extracted rootfs.
- No local marker for the upstream fix commit `a664bf3d603d` was found in the rootfs.

## Why This Is In Scope

Copy Fail is a Linux kernel local privilege escalation in the crypto `authencesn` / `AF_ALG` path. Public guidance says the primary fix is a kernel containing mainline commit `a664bf3d603d`, with temporary mitigation by disabling `algif_aead`.

This rootfs carries the relevant affected modules:

```text
/lib/modules/6.6.28-v8/kernel/crypto/algif_aead.ko.xz
/lib/modules/6.6.28-v8/kernel/crypto/authenc.ko.xz
/lib/modules/6.6.28-v8/kernel/crypto/authencesn.ko.xz
```

The module vermagic for both checked modules is:

```text
6.6.28-v8 SMP preempt mod_unload modversions aarch64
```

`6.6.28` predates the public 2026 Copy Fail fix window. Without source or a vendor changelog proving a backport, assume affected.

## Local Exploitability Notes

The extracted permissions do not show the usual broad setuid surface:

- No setuid files were found with `find . -xdev -type f -perm -4000`.
- No setgid files were found with `find . -xdev -type f -perm -2000`.
- `/bin/su` exists only as a non-setuid symlink to `busybox`.

That means the stock public exploit path that targets a setuid binary such as `/usr/bin/su` likely will not work unchanged on this image.

However, the kernel exposure should still matter for threat modeling:

- If an attacker obtains unprivileged local code execution and can load or trigger `algif_aead`, the vulnerable kernel primitive may be reachable.
- The system appears to run the main game and monitors as root from init. A page-cache corruption primitive may still be adaptable against root-executed readable binaries or scripts, even without classic setuid helpers.
- Embedded deployments often have fewer unprivileged accounts, which lowers exposure, but a network/app compromise that lands in a non-root context could still use this as a step-up if the primitive is reachable.

## Mitigation Options To Test On Hardware

Preferred:

1. Boot a kernel containing the Copy Fail fix or a vendor backport of mainline commit `a664bf3d603d`.
2. Confirm the running kernel version and vendor build date on the machine.
3. Confirm whether `algif_aead` can be autoloaded from an unprivileged process.

Temporary mitigation if patching is not yet possible:

```text
install algif_aead /bin/false
```

Place that in a modprobe policy file if the deployed image honors `/etc/modprobe.d`, then unload `algif_aead` if already loaded. This rootfs did not include an existing `/etc/modprobe.d` directory, so test the exact Buildroot/kmod behavior on hardware before relying on it.

Also consider a seccomp rule blocking `AF_ALG` socket creation for any untrusted workload, though this image does not currently look like a container or multi-user host.

## Commands Used For Static Check

```sh
rg -n "algif_aead|authencesn|AF_ALG|a664bf3d603d|disable-algif" .
find lib/modules/6.6.28-v8 -path '*algif_aead*' -o -path '*authenc*' -o -path '*authencesn*'
xz -dc lib/modules/6.6.28-v8/kernel/crypto/algif_aead.ko.xz | strings | rg -n "vermagic|depends|description|AF_ALG|aead|6\\.6"
xz -dc lib/modules/6.6.28-v8/kernel/crypto/authencesn.ko.xz | strings | rg -n "vermagic|depends|description|authenc|authencesn|6\\.6"
find . -xdev -type f -perm -4000 -exec ls -l {} \;
find . -xdev -type f -perm -2000 -exec ls -l {} \;
```