CVE-2022-0847-eBPF

CVE-2022-0847-eBPF 一个用于检测和防御针对 CVE-2022-0847 攻击的 eBPF 程序。 在内核空间，该程序检测 splice 系统调用，如果此类系统调用包含一个管道作为输出 fd，且管道缓冲区的标志被设置为 PIPEBUFFLAGCANMERGE ，则会提交一个事件。在用户空间，该程序会杀死调用 splice 的对应进程，并覆写 /proc/sys/vm/dropcaches 以清除页面缓存。 已在 Ubuntu Server 20.10（内核 5.8.0-25）上测试。 构建 root@kitploit: clang -g -O2 -target bpf...

CVE-2026-31431

CopyFail CVE-2026-31431 Overview CopyFail is a proof-of-concept exploit for CVE-2026-31431, targeting a memory corruption vulnerability in the Linux Kernel Crypto API AFALG. The exploit leverages the splice system call to perform unauthorized page-cache patching of the /usr/bin/su binary, enablin...

RK35xx-CopyFail-Hotfix

Parche de Kernel RK35xx: CVE-2026-31431 "Copy Fail" Hotfix RK35xx CopyFail: Parche CVE-2026-31431 para Ubuntu 24.04 de Joshua Riek Un parche de kernel precompilado y proporcionado por la comunidad para todas las placas de un solo chip RK35xx Rock 5, Orange Pi 5, NanoPC, etc. que ejecutan Ubuntu...

CVE-2026-31431-Metasploit-exploit

CVE-2026-31431 - Kernel Linux AFALG "Copy Fail" Escalada de Privilegios Local Un módulo automatizado de Post-Explotación para Metasploit que aprovecha CVE-2026-31431 conocido popularmente como "Copy Fail" para realizar una escalada de privilegios local LPE en kernels de Linux vulnerables versione...

CVE-2026-31431-Check

CVE-2026-31431 Copy Fail 漏洞排查脚本 漏洞概述 CVE-2026-31431 Copy Fail 是 Linux 内核本地提权漏洞，通过 AFALG 套接字（address family 38）结合 splice 零拷贝系统调用，绕过文件写权限篡改页缓存（page cache），实现无写权限的 SUID 二进制文件篡改，进而获取 root 权限。 攻击链 root@kitploit: socketAFALG, SOCKSEQPACKET, 0 创建 AFALG 套接字 - bindauthencesnhmacsha256,cbcaes 绑定 AEAD 加密模板 ...

CVE-2026-31431-Copy-Fail---Advanced-LPE-Proof-of-Concept---C-Rewrite

CVE-2026-31431 "Copy Fail" - PoC Avanzado de LPE - Reescritura en C Un PoC Prueba de Concepto avanzado y byte-perfecto de Escalada de Privilegios Local LPE para CVE-2026-31431 , que explota una falla lógica en el subsistema de criptografía del kernel de Linux algifaead. Este repositorio contiene...

cve-2026-31431

CVE-2026-31431 Este documento describe un exploit público en Python relacionado con la vulnerabilidad CVE-2026-31431. El código demuestra la explotación de la falla utilizando primitivas del subsistema AFALG de Linux, operaciones de cifrado AEAD y manipulación de memoria mediante splice, con el...

Exploit for Write-what-where Condition in Linux Linux_Kernel

Dirty Frag - kernel Linux critical Vulnerability- CVE-2026-432...

Copy.Fail Linux Vulnerability

This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API AFALG sockets plus splice to write four bytes at a time straigh...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

CVE-2026-31431 "Copy Fail" - Advanced LPE Proof-of-Concept -...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

CVE-2026-31431 PoC Local Privilege Escalation in the Linux...

Exploit for CVE-2026-31431

Copy Fail CVE-2026-31431 - Comprehensive Writeup 1. Vuln...

Exploit for CVE-2026-31431

copyFail.py — CVE Exploit Analysis Report Summary copyFa...

Exploit for CVE-2026-31431

CVE-2026-31431 Copy Fail Detection Toolkit Detection and an...

Exploit for CVE-2026-31431

Copy-Fail CVE-2026-31431 Static Go PoC This repository contai...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002128)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002128 advisory. The tcpreadsock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of...

EUVD-2013-2096

Malware in sbrugna...

kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system...

K17237: Linux kernel vulnerability CVE-2014-7822

Security Advisory Description The implementation of certain splicewrite file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service system crash or possibly have unspecified other impact...

SUSE: Security Advisory (SUSE-SU-2015:0581-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...