{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "CVE-2026-31431 is a confirmed in-the-wild exploit (CISA KEV) that bypasses file-on-disk integrity monitors. A negative result confirms that memory-only corruption is not currently active on critical nodes." }, "name": "Local Privilege Escalation via Copy-Fail Page Cache Corruption", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1068" ], "related": [ { "hunt": "container-escape-unprivileged", "reason": "Copy-Fail can also be used for container escapes if the host page cache is shared.", "relation": "alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule on the unprivileged bind or the file read is too noisy. This hunt connects the vulnerable state, the crypto setup, the splice-induced read, and the root escalation into a correlated sequence an analyst can trust.", "coverage": [ { "stage": "vulnerability-discovery", "steps": [ "find-vulnerable-hosts", "kernel-inventory" ], "status": "covered" }, { "stage": "unprivileged-crypto-socket-setup", "steps": [ "crypto-socket-setup" ], "status": "covered" }, { "stage": "page-cache-corruption-via-splice", "steps": [ "sensitive-file-reads" ], "status": "covered" }, { "stage": "escalated-root-execution", "steps": [ "escalated-root-processes" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Kernel Vulnerability Identification", "slug": "vulnerability-discovery", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2026-31431", "Kernel versions 4.14 through 6.19", "CISA KEV catalog entry" ] }, { "name": "Unprivileged AF_ALG Socket Configuration", "slug": "unprivileged-crypto-socket-setup", "tactic": "execution", "techniques": [ "T1190" ], "observables": [ "socket.socket(socket.AF_ALG, ...)", "bind((\"aead\", \"authencesn(hmac(sha256),cbc(aes))\"))", "setsockopt level 279 (SOL_ALG)", "process.euid != 0" ] }, { "name": "Page Cache Corruption via Splice", "slug": "page-cache-corruption-via-splice", "tactic": "privilege-escalation", "techniques": [ "T1068" ], "observables": [ "os.splice() calls involving AF_ALG operation socket", "os.open(\"/usr/bin/su\", os.O_RDONLY)", "open.file.path in [\"/etc/pam.d/*\", \"/etc/security/*\", \"/etc/passwd\"]", "splice.file.mode & S_ISUID > 0" ] }, { "name": "Escalated Root Execution", "slug": "escalated-root-execution", "tactic": "privilege-escalation", "techniques": [ "T1068" ], "observables": [ "process.euid == 0", "Execution of tampered /usr/bin/su", "Bypassed PAM authentication" ] } ], "summary": "An unprivileged local user exploits a Linux kernel vulnerability (CVE-2026-31431) by utilizing the AF_ALG crypto socket interface and the splice() syscall to corrupt the page cache of sensitive system files. This allows for persistent, in-memory modification of binaries like /usr/bin/su or configuration files like /etc/pam.d/ to achieve privilege escalation to root without modifying files on disk." }, "severity": "high", "rationale": "Start with internet-facing Linux hosts and container nodes. Focus on hosts where scanners have reported CVE-2026-31431, but expand to all hosts running kernel 4.14 - 6.19.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An unprivileged local attacker exploits CVE-2026-31431 by splicing AF_ALG crypto sockets into the page cache of sensitive system files to achieve root execution without modifying files on disk.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Specific hostnames to scope the behavioral queries; leave empty for whole estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "system_binaries": { "type": "list[path]", "default": [ "/usr/bin/su", "/usr/bin/sudo", "/etc/pam.d/sshd", "/etc/pam.d/common-auth", "/etc/passwd" ], "description": "Sensitive binaries and configs targeted for page cache corruption." }, "exclude_processes": { "type": "list[string]", "default": [ "backup-agent", "vulnerability-scanner", "aide", "tripwire", "rkhunter" ], "description": "Known legitimate readers of system binaries to exclude." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://securitylabs.datadoghq.com/articles/cve-2026-31431-copy-fail-exploit-detection-with-agents/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://securitylabs.datadoghq.com/articles/cve-2026-31431-copy-fail-exploit-detection-with-agents/", "name": "Security Labs Datadog - CVE-2026-31431 Copy-Fail" } ], "blind_spots": [ { "id": "missing-kernel-telemetry", "risk": "If the inventory is stale or missing the linux-image package, the agent cannot confirm if the environment is vulnerable.", "stage": "vulnerability-discovery", "question": "Does the host have an unpatched kernel?", "requires": "accurate kernel version reporting in hb_software_inventory" }, { "id": "no-syscall-telemetry", "risk": "We infer splice() from the unusual unprivileged read of an executable. If the process reads the file normally but doesn't splice it, we may generate false positives.", "stage": "page-cache-corruption-via-splice", "question": "Did the process use splice() specifically?", "requires": "hb_file_activity with activity_id 2 (Read)" } ] }, "name": "Local Privilege Escalation via Copy-Fail Page Cache Corruption", "description": "The 'Copy-Fail' exploit targets a vulnerability in the Linux kernel crypto subsystem. The adversary uses unprivileged AF_ALG sockets and the splice syscall to overwrite memory pages in the kernel page cache. Because this corruption happens in memory rather than on disk, traditional file-integrity monitoring tools and audit logs remain silent as the on-disk inode metadata never changes. This hunt identifies the specific sequence of syscalls and behavioral indicators that precede the escalation. The hunt first scopes the estate to hosts with known kernel vulnerabilities, then searches for unprivileged processes configuring crypto sockets. It then pivots to find evidence of those same processes reading sensitive binaries like /usr/bin/su or PAM configurations\u2014a prerequisite for the memory-only overwrite. Finally, an agent weighs the full chain, including subsequent root execution of fileless or unmapped processes, to confirm exploitation." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "vulnerability-discovery", "steps": [ "find-vulnerable-hosts", "kernel-inventory" ], "status": "covered" }, { "stage": "unprivileged-crypto-socket-setup", "steps": [ "crypto-socket-setup" ], "status": "covered" }, { "stage": "page-cache-corruption-via-splice", "steps": [ "sensitive-file-reads" ], "status": "covered" }, { "stage": "escalated-root-execution", "steps": [ "escalated-root-processes" ], "status": "covered" } ], "rationale": "An unprivileged local attacker exploits CVE-2026-31431 by splicing AF_ALG crypto sockets into the page cache of sensitive system files to achieve root execution without modifying files on disk.", "blind_spots": [ { "id": "missing-kernel-telemetry", "risk": "If the inventory is stale or missing the linux-image package, the agent cannot confirm if the environment is vulnerable.", "stage": "vulnerability-discovery", "question": "Does the host have an unpatched kernel?", "requires": "accurate kernel version reporting in hb_software_inventory" }, { "id": "no-syscall-telemetry", "risk": "We infer splice() from the unusual unprivileged read of an executable. If the process reads the file normally but doesn't splice it, we may generate false positives.", "stage": "page-cache-corruption-via-splice", "question": "Did the process use splice() specifically?", "requires": "hb_file_activity with activity_id 2 (Read)" } ], "scoping_notes": "Start with internet-facing Linux hosts and container nodes. Focus on hosts where scanners have reported CVE-2026-31431, but expand to all hosts running kernel 4.14 - 6.19.", "beyond_detection": "A single rule on the unprivileged bind or the file read is too noisy. This hunt connects the vulnerable state, the crypto setup, the splice-induced read, and the root escalation into a correlated sequence an analyst can trust." } }, { "id": "find-vulnerable-hosts", "type": "query", "label": "Identify vulnerable kernel findings", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_uid, cve_uid, severity, status, first_seen FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2026-31431' AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Scope the hunt to hosts where vulnerability scanners have already flagged CVE-2026-31431.", "expected_signal": "A list of device UIDs with the specific CVE finding. Silence means the scanner has not detected the flaw, not that the kernel is safe." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify vulnerable kernel findings", "reads": [ "device_uid", "cve_uid", "severity", "status", "first_seen" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, cve_uid, severity, status, first_seen FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2026-31431' AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "A list of device UIDs with the specific CVE finding. Silence means the scanner has not detected the flaw, not that the kernel is safe.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "crypto-socket-setup", "type": "query", "label": "Unprivileged AF_ALG socket setup", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%af_alg%' OR LOWER(process_cmd_line) LIKE '%authencesn%') AND user_name != 'root' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find non-root processes referencing the kernel crypto algorithms used by the Copy-Fail exploit.", "expected_signal": "Standard users interacting with the crypto subsystem. This is the first behavioral marker of the exploit." }, "parents": [ { "id": "find-vulnerable-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Unprivileged AF_ALG socket setup", "reads": [ "device_hostname", "user_name", "process_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%af_alg%' OR LOWER(process_cmd_line) LIKE '%authencesn%') AND user_name != 'root' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Standard users interacting with the crypto subsystem. This is the first behavioral marker of the exploit.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "kernel-inventory", "type": "query", "label": "Fleet-wide kernel version inventory", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT package_version, COUNT(DISTINCT device_hostname) AS host_count, MIN(collected_at) AS first_seen FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%linux-image%' OR LOWER(package_name) = 'kernel') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY package_version", "surface": "hb_software_inventory", "description": "Stack-count kernel versions to identify hosts in the vulnerable range (4.14 - 6.19).", "expected_signal": "A list of kernel versions across the estate. Rare versions on systems showing crypto activity are higher priority." }, "parents": [ { "id": "find-vulnerable-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Fleet-wide kernel version inventory", "reads": [ "package_name", "package_version", "device_hostname", "collected_at" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT package_version, COUNT(DISTINCT device_hostname) AS host_count, MIN(collected_at) AS first_seen FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%linux-image%' OR LOWER(package_name) = 'kernel') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY package_version", "silence": "evidence_of_absence", "baseline": { "window": "30d", "compare": "first_seen" }, "expected": "A list of kernel versions across the estate. Rare versions on systems showing crypto activity are higher priority.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "package_version" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Assess exploit preparation", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "find-vulnerable-hosts", "crypto-socket-setup", "kernel-inventory" ], "objective": "Identify suspicious AF_ALG socket configurations on hosts with kernel versions between 4.14 and 6.19.", "description": "The agent reviews vulnerability findings and process telemetry to identify processes preparing for page cache corruption.", "max_iterations": 4, "expected_signal": "A verdict per host indicating if an unprivileged user is interacting with crypto interfaces on a vulnerable kernel (4.14 - 6.19).", "success_criteria": "A list of hosts and PIDs with confirmed exploit preparation behaviors." }, "parents": [ { "id": "crypto-socket-setup", "kind": "merge" }, { "id": "kernel-inventory", "kind": "merge" } ] }, { "id": "sensitive-file-reads", "type": "query", "label": "Unprivileged reads of execution-only files", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, actor_user_name, process_name, file_path, time FROM hb_file_activity WHERE activity_id = 2 AND (instr(',' || '{{system_binaries}}' || ',', ',' || file_path || ',') > 0) AND actor_user_name != 'root' AND NOT (instr(',' || '{{exclude_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Identify standard users reading sensitive binaries or configurations, which Copy-Fail does via splice to corrupt memory.", "expected_signal": "Read-only access to su, sudo, or PAM files by unprivileged users. Legitimate scanners are excluded to minimize noise." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Unprivileged reads of execution-only files", "reads": [ "device_hostname", "actor_user_name", "process_name", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, actor_user_name, process_name, file_path, time FROM hb_file_activity WHERE activity_id = 2 AND (instr(',' || '{{system_binaries}}' || ',', ',' || file_path || ',') > 0) AND actor_user_name != 'root' AND NOT (instr(',' || '{{exclude_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Read-only access to su, sudo, or PAM files by unprivileged users. Legitimate scanners are excluded to minimize noise.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "escalated-root-processes", "type": "query", "label": "Escalated root execution and fileless code", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_path, process_cmd_line, on_disk, time FROM hb_process_activity WHERE user_name = 'root' AND (on_disk = 0 OR process_path IS NULL OR LOWER(process_path) LIKE '/tmp/%' OR LOWER(process_path) LIKE '/dev/shm/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find root processes that were likely launched after successful memory corruption, focusing on those with no disk backing.", "expected_signal": "New root processes running from memory or temporary paths. This confirms the exploit achieved its objective." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Escalated root execution and fileless code", "reads": [ "device_hostname", "user_name", "process_name", "process_path", "process_cmd_line", "on_disk", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_path, process_cmd_line, on_disk, time FROM hb_process_activity WHERE user_name = 'root' AND (on_disk = 0 OR process_path IS NULL OR LOWER(process_path) LIKE '/tmp/%' OR LOWER(process_path) LIKE '/dev/shm/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "New root processes running from memory or temporary paths. This confirms the exploit achieved its objective.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "final-chain-analysis", "type": "analytic", "label": "Verify full exploit chain", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-stage-triage", "sensitive-file-reads", "escalated-root-processes" ], "objective": "Confirm if any host shows the sequence: vulnerable kernel + unprivileged AF_ALG bind + unprivileged system binary read + root execution.", "description": "The agent connects the early preparation, the splicing behavior, and the root escalation into a single narrative.", "max_iterations": 5, "expected_signal": "A high-confidence verdict for any host showing the complete Copy-Fail sequence.", "success_criteria": "A verdict of 'compromised' for any host with correlated prepara\u00e7\u00e3o and escalation telemetry." }, "parents": [ { "id": "sensitive-file-reads", "kind": "merge" }, { "id": "escalated-root-processes", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on exploit verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "The final-chain-analysis verdict is 'compromised' for any host.", "condition": "The final-chain-analysis verdict is 'compromised' for any host.", "blind_spot": "missing-kernel-telemetry", "confidence": "high", "description": "Route the hunt to immediate isolation or manual analyst review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-chain-analysis" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Contain the threat by isolating the host where kernel exploitation was confirmed.", "instructions": "Isolate the host immediately. Because this exploit corrupts memory pages, collect a memory dump before rebooting if possible, but prioritize network containment.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Final analyst review", "config": { "assignee": "analyst", "description": "Verify the agent's reasoning and confirm the malicious nature of the detected root processes.", "instructions": "Review the correlated timeline in final-chain-analysis. Specifically, confirm if the root shell (on_disk=0) appeared after an unprivileged user read /usr/bin/su. If no vulnerability findings existed for the host, verify the kernel version manually." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Document results and remediation", "config": { "assignee": "analyst", "description": "Record the hunt results and suggest broader hardening measures.", "instructions": "Document every host found with a vulnerable kernel. Prioritize applying AppArmor or SELinux profiles to restrict AF_ALG socket creation for unprivileged users across the estate." }, "parents": [ { "id": "analyst-review" } ] } ] }