82 lines
4.0 KiB
Markdown
82 lines
4.0 KiB
Markdown
# Copy Fail Assessment
|
|
|
|
## Short Answer
|
|
|
|
Based on the extracted rootfs, this kernel should be treated as vulnerable to Copy Fail / CVE-2026-31431 unless Stern or Raspberry Pi backported the fix into this exact `6.6.28-v8` kernel build out-of-band.
|
|
|
|
The available local evidence points vulnerable:
|
|
|
|
- Kernel module tree is `/lib/modules/6.6.28-v8`.
|
|
- `algif_aead.ko.xz` is present as a loadable module.
|
|
- `authencesn.ko.xz` is present as a loadable module.
|
|
- `modules.dep` wires both into the normal module dependency map.
|
|
- `algif_aead` module metadata describes it as `AEAD kernel crypto API user space interface`.
|
|
- `authencesn` module metadata describes it as `AEAD wrapper for IPsec with extended sequence numbers`.
|
|
- No `/etc/modprobe.d` mitigation was present in the extracted rootfs.
|
|
- No local marker for the upstream fix commit `a664bf3d603d` was found in the rootfs.
|
|
|
|
## Why This Is In Scope
|
|
|
|
Copy Fail is a Linux kernel local privilege escalation in the crypto `authencesn` / `AF_ALG` path. Public guidance says the primary fix is a kernel containing mainline commit `a664bf3d603d`, with temporary mitigation by disabling `algif_aead`.
|
|
|
|
This rootfs carries the relevant affected modules:
|
|
|
|
```text
|
|
/lib/modules/6.6.28-v8/kernel/crypto/algif_aead.ko.xz
|
|
/lib/modules/6.6.28-v8/kernel/crypto/authenc.ko.xz
|
|
/lib/modules/6.6.28-v8/kernel/crypto/authencesn.ko.xz
|
|
```
|
|
|
|
The module vermagic for both checked modules is:
|
|
|
|
```text
|
|
6.6.28-v8 SMP preempt mod_unload modversions aarch64
|
|
```
|
|
|
|
`6.6.28` predates the public 2026 Copy Fail fix window. Without source or a vendor changelog proving a backport, assume affected.
|
|
|
|
## Local Exploitability Notes
|
|
|
|
The extracted permissions do not show the usual broad setuid surface:
|
|
|
|
- No setuid files were found with `find . -xdev -type f -perm -4000`.
|
|
- No setgid files were found with `find . -xdev -type f -perm -2000`.
|
|
- `/bin/su` exists only as a non-setuid symlink to `busybox`.
|
|
|
|
That means the stock public exploit path that targets a setuid binary such as `/usr/bin/su` likely will not work unchanged on this image.
|
|
|
|
However, the kernel exposure should still matter for threat modeling:
|
|
|
|
- If an attacker obtains unprivileged local code execution and can load or trigger `algif_aead`, the vulnerable kernel primitive may be reachable.
|
|
- The system appears to run the main game and monitors as root from init. A page-cache corruption primitive may still be adaptable against root-executed readable binaries or scripts, even without classic setuid helpers.
|
|
- Embedded deployments often have fewer unprivileged accounts, which lowers exposure, but a network/app compromise that lands in a non-root context could still use this as a step-up if the primitive is reachable.
|
|
|
|
## Mitigation Options To Test On Hardware
|
|
|
|
Preferred:
|
|
|
|
1. Boot a kernel containing the Copy Fail fix or a vendor backport of mainline commit `a664bf3d603d`.
|
|
2. Confirm the running kernel version and vendor build date on the machine.
|
|
3. Confirm whether `algif_aead` can be autoloaded from an unprivileged process.
|
|
|
|
Temporary mitigation if patching is not yet possible:
|
|
|
|
```text
|
|
install algif_aead /bin/false
|
|
```
|
|
|
|
Place that in a modprobe policy file if the deployed image honors `/etc/modprobe.d`, then unload `algif_aead` if already loaded. This rootfs did not include an existing `/etc/modprobe.d` directory, so test the exact Buildroot/kmod behavior on hardware before relying on it.
|
|
|
|
Also consider a seccomp rule blocking `AF_ALG` socket creation for any untrusted workload, though this image does not currently look like a container or multi-user host.
|
|
|
|
## Commands Used For Static Check
|
|
|
|
```sh
|
|
rg -n "algif_aead|authencesn|AF_ALG|a664bf3d603d|disable-algif" .
|
|
find lib/modules/6.6.28-v8 -path '*algif_aead*' -o -path '*authenc*' -o -path '*authencesn*'
|
|
xz -dc lib/modules/6.6.28-v8/kernel/crypto/algif_aead.ko.xz | strings | rg -n "vermagic|depends|description|AF_ALG|aead|6\\.6"
|
|
xz -dc lib/modules/6.6.28-v8/kernel/crypto/authencesn.ko.xz | strings | rg -n "vermagic|depends|description|authenc|authencesn|6\\.6"
|
|
find . -xdev -type f -perm -4000 -exec ls -l {} \;
|
|
find . -xdev -type f -perm -2000 -exec ls -l {} \;
|
|
```
|