Skip to content

[cherry-pick v20260424] fix: mitigate CVE-2026-31431 (Copy Fail) algif_aead LPE #8444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Devinwong merged 4 commits into from
May 1, 2026
Merged

[cherry-pick v20260424] fix: mitigate CVE-2026-31431 (Copy Fail) algif_aead LPE #8444

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6aa5bbd
fix: mitigate CVE-2026-31431 (Copy Fail) on Ubuntu VHDs
djsly Apr 30, 2026
dba54ea
fix: extend CVE-2026-31431 mitigation to AzureLinux 3.0
djsly Apr 30, 2026
a60dbbb
fix: add blacklist directive and improve rmmod logging per review
djsly Apr 30, 2026
633fdbd
chore: auto-generate hotfix template entries
aks-node-assistant[bot] May 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions parts/linux/cloud-init/artifacts/cse_main.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -284,6 +284,23 @@ EOF

logs_to_events "AKS.CSE.ensureSysctl" ensureSysctl || exit $ERR_SYSCTL_RELOAD

# CVE-2026-31431 (Copy Fail): Mitigate algif_aead LPE vulnerability.
# Affects Ubuntu 20.04/22.04/24.04 and AzureLinux 3.0 (kernel >=4.15).
# Applies to existing VHDs that don't yet have the modprobe-CIS.conf fix baked in.
# Safe to run unconditionally — idempotent if already mitigated.
if [ "$OS" = "$UBUNTU_OS_NAME" ] || isMarinerOrAzureLinux "$OS"; then
if ! grep -qs "algif_aead" /etc/modprobe.d/*.conf 2>/dev/null; then
printf "install algif_aead /bin/false\nblacklist algif_aead\n" > /etc/modprobe.d/disable-algif_aead.conf
Comment on lines +292 to +293
Copy link

Copilot AI May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The idempotency check treats any occurrence of the string algif_aead in any /etc/modprobe.d/*.conf as “already mitigated”. That can produce false positives (e.g., comments/aliases) and skip writing the required install ... /bin/false + blacklist ... rules. Consider checking specifically for the required directives (or ensuring the expected file exists with correct contents) before deciding to skip creating/updating the mitigation file.

Suggested change
if ! grep -qs "algif_aead" /etc/modprobe.d/*.conf 2>/dev/null; then
printf "install algif_aead /bin/false\nblacklist algif_aead\n" > /etc/modprobe.d/disable-algif_aead.conf
if ! grep -qsE '^[[:space:]]*install[[:space:]]+algif_aead[[:space:]]+/bin/false([[:space:]]|$)' /etc/modprobe.d/disable-algif_aead.conf 2>/dev/null || \
! grep -qsE '^[[:space:]]*blacklist[[:space:]]+algif_aead([[:space:]]|$)' /etc/modprobe.d/disable-algif_aead.conf 2>/dev/null; then
tee /etc/modprobe.d/disable-algif_aead.conf > /dev/null <<'EOF'
install algif_aead /bin/false
blacklist algif_aead
EOF

Copilot uses AI. Check for mistakes.
fi
if grep -q '^algif_aead ' /proc/modules 2>/dev/null; then
if rmmod algif_aead 2>/dev/null; then
echo "CVE-2026-31431: successfully unloaded algif_aead module"
else
echo "CVE-2026-31431: failed to unload algif_aead (in use), reboot required for full mitigation"
fi
Comment on lines +295 to +300
Copy link

Copilot AI May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rmmod algif_aead will fail if the module has dependents, even when unloading would otherwise be possible. Using modprobe -r algif_aead is generally more robust because it removes dependencies in the right order and yields clearer failure modes for the “reboot required” message.

Copilot uses AI. Check for mistakes.
fi
fi

if ! isAzureLinuxOSGuard "$OS" "$OS_VARIANT"; then
if [ "$OS" = "$UBUNTU_OS_NAME" ] || isMarinerOrAzureLinux "$OS"; then
logs_to_events "AKS.CSE.ubuntuSnapshotUpdate" ensureSnapshotUpdate
Expand Down
4 changes: 4 additions & 0 deletions parts/linux/cloud-init/artifacts/modprobe-CIS.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,7 @@ blacklist hfsplus
# 1.1.1.9 Ensure usb-storage kernel module is not available
install usb-storage /bin/true
blacklist usb-storage
# CVE-2026-31431 (Copy Fail): Disable algif_aead to mitigate LPE vulnerability
# until kernel fix is available. See https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available
install algif_aead /bin/false
Copy link

Copilot AI May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

modprobe-CIS.conf consistently disables modules with install <module> /bin/true + blacklist <module>, but this change uses /bin/false for algif_aead. Using /bin/false makes modprobe algif_aead fail and could cause unexpected failures in any consumers that attempt to load it. Consider aligning to /bin/true like the other entries, or add a short note explaining why algif_aead is intentionally different here.

Suggested change
install algif_aead /bin/false
install algif_aead /bin/true

Copilot uses AI. Check for mistakes.
blacklist algif_aead
10 changes: 10 additions & 0 deletions parts/linux/cloud-init/nodecustomdata.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,16 @@ write_files:
Any overridden files will be listed here - Hotfix mode
Example: {{GetCSEHelpersScriptFilepath}}


# ---- hotfix: auto-generated by hotfix-generate GH Action ----
- path: /opt/azure/containers/provision.sh
permissions: "0744"
encoding: gzip
owner: root
content: !!binary |
{{GetVariableProperty "cloudInitData" "provisionScript"}}

# ---- end hotfix ----
{{- else }}
- path: {{GetCSEHelpersScriptFilepath}}
permissions: "0744"
Expand Down
Loading