{"uuid": "8a418652-340e-437c-8a9a-d0cef005e63b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/shishir-salam/d73a9a5137ac7e958c727edcab5bc3d2", "content": "#!/bin/bash\n################################################################################\n# Linux Kernel Security Patching Script\n#\n# Purpose: Apply kernel security updates to patch:\n#   - Copy Fail vulnerability (CVE-2026-31431 / algif_aead)\n#   - Dirty Frag vulnerability (net packet fragmentation)\n# Usage: sudo ./apply-kernel-patch.sh\n# WARNING: This will update the kernel and require a reboot\n################################################################################\n\nset -euo pipefail\n\n# Colors\nRED='\\033[0;31m'\nGREEN='\\033[0;32m'\nYELLOW='\\033[1;33m'\nNC='\\033[0m'\n\nSCRIPT_VERSION=\"2.4\"\nCVE_ID=\"CVE-2026-31431\"\nPATCH_DATE=$(date -u +\"%Y-%m-%dT%H:%M:%SZ\")\nLOG_FILE=\"/var/log/kernel-security-patching.log\"\nS3_BUCKET=\"${1:-eps-server-prep}\"\nRESULTS_PREFIX=\"results\"\nAUTO_REBOOT=\"${2:-yes}\"\nMINIMUM_FIXED_KERNEL=\"6.1.170-210.320.amzn2023\"\n\necho \"==========================================\"\necho \"Linux Kernel Security Patching\"\necho \"Targets: Copy Fail + Dirty Frag\"\necho \"Version: $SCRIPT_VERSION\"\necho \"Date: $PATCH_DATE\"\necho \"==========================================\"\necho \"\"\n\n# Check root\nif [[ $EUID -ne 0 ]]; then\n   echo -e \"${RED}ERROR: This script must be run as root${NC}\"\n   exit 1\nfi\n\n# Log function\nlog() {\n    echo \"[$(date -u +\"%Y-%m-%d %H:%M:%S UTC\")] $1\" | tee -a \"$LOG_FILE\"\n}\n\nlog \"Starting kernel patching for $CVE_ID\"\n\n# Get system information\nHOSTNAME=$(hostname)\nDISTRO=$(grep ^ID= /etc/os-release | cut -d= -f2 | tr -d '\"')\nCURRENT_KERNEL=$(uname -r)\n\necho \"System Information:\"\necho \"  Hostname: $HOSTNAME\"\necho \"  Distribution: $DISTRO\"\necho \"  Current Kernel: $CURRENT_KERNEL\"\necho \"\"\n\n# Step 1: Pre-patch backup\necho \"[1/5] Creating pre-patch snapshot information...\"\nlog \"Creating pre-patch snapshot\"\n\ncat > \"/var/log/cve-2026-31431-pre-patch-snapshot.txt\" <> \"/var/log/cve-2026-31431-pre-patch-snapshot.txt\"\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    dpkg -l | grep linux-image >> \"/var/log/cve-2026-31431-pre-patch-snapshot.txt\"\nfi\n\nlog \"Pre-patch snapshot saved\"\necho -e \"${GREEN}  Snapshot created${NC}\"\n\n# Step 2: Update package repositories\necho \"\"\necho \"[2/5] Updating package repositories...\"\nlog \"Updating package repositories\"\n\nif [ \"$DISTRO\" == \"amzn\" ] || [ \"$DISTRO\" == \"rhel\" ]; then\n    if yum check-update -q 2>/dev/null; then\n        echo \"  Repository check completed\"\n    fi\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    apt-get update -qq\nfi\n\nlog \"Package repositories updated\"\necho -e \"${GREEN}  Repositories updated${NC}\"\n\n# Helper function to compare kernel versions\ncompare_kernel_versions() {\n    local current=\"$1\"\n    local minimum=\"$2\"\n\n    # Extract version components (6.1.170-210.320.amzn2023.x86_64 -> 6 1 170 210 320)\n    local curr_major=$(echo \"$current\" | cut -d. -f1)\n    local curr_minor=$(echo \"$current\" | cut -d. -f2)\n    local curr_patch=$(echo \"$current\" | cut -d. -f3 | cut -d- -f1)\n    local curr_build1=$(echo \"$current\" | cut -d- -f2 | cut -d. -f1)\n    local curr_build2=$(echo \"$current\" | cut -d- -f2 | cut -d. -f2)\n\n    local min_major=$(echo \"$minimum\" | cut -d. -f1)\n    local min_minor=$(echo \"$minimum\" | cut -d. -f2)\n    local min_patch=$(echo \"$minimum\" | cut -d. -f3 | cut -d- -f1)\n    local min_build1=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f1)\n    local min_build2=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f2)\n\n    # Compare each component\n    if [ \"$curr_major\" -gt \"$min_major\" ]; then return 0; fi\n    if [ \"$curr_major\" -lt \"$min_major\" ]; then return 1; fi\n\n    if [ \"$curr_minor\" -gt \"$min_minor\" ]; then return 0; fi\n    if [ \"$curr_minor\" -lt \"$min_minor\" ]; then return 1; fi\n\n    if [ \"$curr_patch\" -gt \"$min_patch\" ]; then return 0; fi\n    if [ \"$curr_patch\" -lt \"$min_patch\" ]; then return 1; fi\n\n    if [ \"$curr_build1\" -gt \"$min_build1\" ]; then return 0; fi\n    if [ \"$curr_build1\" -lt \"$min_build1\" ]; then return 1; fi\n\n    if [ \"$curr_build2\" -ge \"$min_build2\" ]; then return 0; fi\n    return 1\n}\n\n# Step 3: Check for kernel updates\necho \"\"\necho \"[3/5] Checking for kernel updates...\"\nlog \"Checking for kernel updates\"\necho \"  Minimum required kernel: $MINIMUM_FIXED_KERNEL\"\necho \"  Current kernel: $CURRENT_KERNEL\"\n\nUPDATES_AVAILABLE=false\nVULN_FIX_STATUS=\"UNKNOWN\"\n\n# Check if current kernel meets minimum version\nif compare_kernel_versions \"$CURRENT_KERNEL\" \"$MINIMUM_FIXED_KERNEL\"; then\n    echo -e \"  ${GREEN}\u2713 Current kernel meets or exceeds minimum fixed version${NC}\"\n    log \"Current kernel $CURRENT_KERNEL meets minimum $MINIMUM_FIXED_KERNEL\"\n\n    # Verify vulnerabilities are actually fixed\n    echo \"\"\n    echo \"  Verifying vulnerability status...\"\n\n    # Check Copy Fail (algif_aead)\n    COPY_FAIL_STATUS=\"UNKNOWN\"\n    if modinfo algif_aead &>/dev/null; then\n        if lsmod | grep -q algif_aead; then\n            echo -e \"  ${YELLOW}\u26a0 Copy Fail: algif_aead module loaded (check if mitigation active)${NC}\"\n            COPY_FAIL_STATUS=\"MITIGATED\"\n        else\n            echo -e \"  ${GREEN}\u2713 Copy Fail: algif_aead present but not loaded (MITIGATED)${NC}\"\n            COPY_FAIL_STATUS=\"MITIGATED\"\n        fi\n    else\n        echo -e \"  ${GREEN}\u2713 Copy Fail: algif_aead module not in kernel (FIXED)${NC}\"\n        COPY_FAIL_STATUS=\"FIXED\"\n    fi\n\n    # Dirty Frag is fixed in kernel 6.1.170+\n    echo -e \"  ${GREEN}\u2713 Dirty Frag: Fixed in kernel $CURRENT_KERNEL${NC}\"\n    DIRTY_FRAG_STATUS=\"FIXED\"\n\n    echo \"\"\n    echo -e \"${GREEN}System is on fixed kernel version. No update needed.${NC}\"\n    echo \"\"\n    echo \"Current kernel: $CURRENT_KERNEL\"\n    echo \"Copy Fail Status: $COPY_FAIL_STATUS\"\n    echo \"Dirty Frag Status: $DIRTY_FRAG_STATUS\"\n    echo \"\"\n    log \"No updates needed - kernel $CURRENT_KERNEL is fixed\"\n\n    # Upload verification results\n    cat > \"/var/log/cve-2026-31431-patch-status.json\" </dev/null; then\n        echo -e \"${GREEN}  Results uploaded to s3://$S3_BUCKET/$RESULTS_PREFIX/$RESULT_FILE${NC}\"\n    fi\n\n    exit 0\nfi\n\necho -e \"  ${YELLOW}Current kernel is below minimum fixed version${NC}\"\nlog \"Current kernel $CURRENT_KERNEL is below minimum $MINIMUM_FIXED_KERNEL\"\n\nif [ \"$DISTRO\" == \"amzn\" ] || [ \"$DISTRO\" == \"rhel\" ]; then\n    # Check if the fixed kernel is already installed (e.g., after rollback)\n    if rpm -qa kernel | grep -q \"$MINIMUM_FIXED_KERNEL\"; then\n        echo \"\"\n        echo -e \"  ${GREEN}Fixed kernel $MINIMUM_FIXED_KERNEL is already installed${NC}\"\n        echo \"  Setting GRUB default to use the fixed kernel...\"\n        log \"Fixed kernel already installed, updating GRUB default\"\n\n        # Set GRUB default to the fixed kernel\n        if grubby --set-default /boot/vmlinuz-$MINIMUM_FIXED_KERNEL 2>&1 | tee -a \"$LOG_FILE\"; then\n            echo -e \"  ${GREEN}GRUB default updated to fixed kernel${NC}\"\n            log \"SUCCESS: GRUB default set to $MINIMUM_FIXED_KERNEL\"\n\n            NEW_KERNEL_INSTALLED=\"kernel-$MINIMUM_FIXED_KERNEL\"\n            UPDATES_AVAILABLE=false\n            VULN_FIX_STATUS=\"TO_BE_VERIFIED_POST_REBOOT\"\n\n            # Skip to save patch status section\n        else\n            echo -e \"  ${RED}Failed to update GRUB default${NC}\"\n            log \"ERROR: Failed to set GRUB default\"\n            exit 1\n        fi\n    else\n        echo \"\"\n        echo \"  Attempting kernel update using AWS recommended method...\"\n        echo \"  Using: dnf update kernel --releasever 2023.11.20260509\"\n        log \"Forcing kernel update with releasever 2023.11.20260509\"\n\n        UPDATES_AVAILABLE=true\n        VULN_FIX_STATUS=\"TO_BE_VERIFIED_POST_REBOOT\"\n    fi\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    if apt-cache policy linux-image-generic | grep -q \"Candidate:\"; then\n        UPDATES_AVAILABLE=true\n        AVAILABLE_KERNEL=$(apt-cache policy linux-image-generic | grep Candidate | awk '{print $2}')\n        echo \"  Kernel update available: $AVAILABLE_KERNEL\"\n        log \"Kernel update available: $AVAILABLE_KERNEL\"\n\n        echo \"\"\n        echo \"  Proceeding with kernel update to latest version\"\n        log \"Proceeding with kernel update\"\n        VULN_FIX_STATUS=\"TO_BE_VERIFIED_POST_REBOOT\"\n    else\n        echo \"  No kernel updates available - already on latest kernel\"\n        log \"No updates available - system on latest kernel\"\n        echo \"\"\n        echo -e \"${YELLOW}System is already on the latest available kernel.${NC}\"\n        echo \"Current kernel: $CURRENT_KERNEL\"\n        echo \"\"\n        log \"No updates available - exiting\"\n        exit 0\n    fi\nfi\n\n# Step 4: Apply kernel updates (only if not already installed)\nif [ \"$UPDATES_AVAILABLE\" = true ]; then\n    echo \"\"\n    echo \"[4/5] Applying kernel updates...\"\n    log \"Applying kernel updates\"\n\n    echo -e \"${YELLOW}Proceeding with kernel update (automated deployment)${NC}\"\n    log \"Automated kernel update initiated\"\n\n    if [ \"$DISTRO\" == \"amzn\" ] || [ \"$DISTRO\" == \"rhel\" ]; then\n        # AWS recommended command for Amazon Linux 2023\n        log \"Running: dnf update kernel --releasever 2023.11.20260509 -y\"\n        echo \"  Using AWS recommended update command with releasever 2023.11.20260509\"\n        if dnf update kernel --releasever 2023.11.20260509 -y 2>&1 | tee -a \"$LOG_FILE\"; then\n            log \"SUCCESS: Kernel updated successfully\"\n            echo -e \"${GREEN}  Kernel updated successfully${NC}\"\n        else\n            log \"ERROR: Kernel update failed\"\n            echo -e \"${RED}  Kernel update failed${NC}\"\n            exit 1\n        fi\n    fi\nelse\n    echo \"\"\n    echo \"[4/5] Kernel update skipped (already installed, GRUB updated)\"\n    log \"Skipped dnf update - kernel already installed, GRUB updated\"\nfi\n\nif [ \"$UPDATES_AVAILABLE\" = true ]; then\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    log \"Running: apt-get upgrade linux-image-generic -y\"\n    if apt-get upgrade linux-image-generic -y 2>&1 | tee -a \"$LOG_FILE\"; then\n        log \"SUCCESS: Kernel updated successfully\"\n        echo -e \"${GREEN}  Kernel updated successfully${NC}\"\n    else\n        log \"ERROR: Kernel update failed\"\n        echo -e \"${RED}  Kernel update failed${NC}\"\n        exit 1\n    fi\nfi\n\n# Step 5: Post-patch verification\necho \"\"\necho \"[5/5] Post-patch verification...\"\nlog \"Performing post-patch verification\"\n\nNEW_KERNEL_INSTALLED=$(rpm -qa kernel --last 2>/dev/null | head -1 | awk '{print $1}' || dpkg -l | grep linux-image | tail -1 | awk '{print $3}')\necho \"  New kernel installed: $NEW_KERNEL_INSTALLED\"\nlog \"New kernel installed: $NEW_KERNEL_INSTALLED\"\n\n# Save patch status\ncat > \"/var/log/cve-2026-31431-patch-status.json\" </dev/null; then\n    echo -e \"${GREEN}  Results uploaded to s3://$S3_BUCKET/$RESULTS_PREFIX/$RESULT_FILE${NC}\"\n    log \"Results uploaded to S3 successfully\"\nelse\n    echo -e \"${YELLOW}  Warning: Could not upload results to S3${NC}\"\n    log \"WARNING: S3 upload failed\"\nfi\n\n# Final summary\necho \"\"\necho \"==========================================\"\necho \"PATCHING SUMMARY\"\necho \"==========================================\"\necho -e \"${GREEN}Status: PATCH APPLIED${NC}\"\necho \"\"\necho \"Previous kernel: $CURRENT_KERNEL\"\necho \"New kernel: $NEW_KERNEL_INSTALLED\"\necho \"\"\necho \"Vulnerability Fix Status: Will be verified after reboot\"\necho \"\"\n\n# Schedule post-reboot verification\ncat > \"/var/lib/cloud/scripts/per-boot/verify-kernel-patch.sh\" <<'VERIFY_EOF'\n#!/bin/bash\n# Post-reboot verification script\nHOSTNAME=$(hostname)\nCURRENT_KERNEL=$(uname -r)\nS3_BUCKET=\"eps-server-prep\"\nRESULTS_PREFIX=\"results\"\nMINIMUM_FIXED_KERNEL=\"6.1.170-210.320.amzn2023\"\n\n# Helper function to compare kernel versions\ncompare_kernel_versions() {\n    local current=\"$1\"\n    local minimum=\"$2\"\n\n    local curr_major=$(echo \"$current\" | cut -d. -f1)\n    local curr_minor=$(echo \"$current\" | cut -d. -f2)\n    local curr_patch=$(echo \"$current\" | cut -d. -f3 | cut -d- -f1)\n    local curr_build1=$(echo \"$current\" | cut -d- -f2 | cut -d. -f1)\n    local curr_build2=$(echo \"$current\" | cut -d- -f2 | cut -d. -f2)\n\n    local min_major=$(echo \"$minimum\" | cut -d. -f1)\n    local min_minor=$(echo \"$minimum\" | cut -d. -f2)\n    local min_patch=$(echo \"$minimum\" | cut -d. -f3 | cut -d- -f1)\n    local min_build1=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f1)\n    local min_build2=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f2)\n\n    if [ \"$curr_major\" -gt \"$min_major\" ]; then return 0; fi\n    if [ \"$curr_major\" -lt \"$min_major\" ]; then return 1; fi\n    if [ \"$curr_minor\" -gt \"$min_minor\" ]; then return 0; fi\n    if [ \"$curr_minor\" -lt \"$min_minor\" ]; then return 1; fi\n    if [ \"$curr_patch\" -gt \"$min_patch\" ]; then return 0; fi\n    if [ \"$curr_patch\" -lt \"$min_patch\" ]; then return 1; fi\n    if [ \"$curr_build1\" -gt \"$min_build1\" ]; then return 0; fi\n    if [ \"$curr_build1\" -lt \"$min_build1\" ]; then return 1; fi\n    if [ \"$curr_build2\" -ge \"$min_build2\" ]; then return 0; fi\n    return 1\n}\n\n# Check if kernel meets minimum version\nKERNEL_VERSION_STATUS=\"UNKNOWN\"\nif compare_kernel_versions \"$CURRENT_KERNEL\" \"$MINIMUM_FIXED_KERNEL\"; then\n    KERNEL_VERSION_STATUS=\"MEETS_MINIMUM\"\nelse\n    KERNEL_VERSION_STATUS=\"BELOW_MINIMUM\"\nfi\n\n# Check Copy Fail vulnerability\nCOPY_FAIL_STATUS=\"UNKNOWN\"\nif modinfo algif_aead &>/dev/null; then\n    if lsmod | grep -q algif_aead; then\n        COPY_FAIL_STATUS=\"STILL_VULNERABLE\"\n    else\n        COPY_FAIL_STATUS=\"MITIGATED\"\n    fi\nelse\n    COPY_FAIL_STATUS=\"FIXED\"\nfi\n\n# Check Dirty Frag - fixed in kernel 6.1.170+\nDIRTY_FRAG_STATUS=\"UNKNOWN\"\nif [ \"$KERNEL_VERSION_STATUS\" == \"MEETS_MINIMUM\" ]; then\n    DIRTY_FRAG_STATUS=\"FIXED\"\nelse\n    DIRTY_FRAG_STATUS=\"NOT_FIXED\"\nfi\n\n# Check for Phase 1 mitigation file\nif [ -f \"/etc/modprobe.d/disable-algif-aead-cve-2026-31431.conf\" ]; then\n    MITIGATION_ACTIVE=\"YES\"\nelse\n    MITIGATION_ACTIVE=\"NO\"\nfi\n\n# Determine overall status\nOVERALL_STATUS=\"UNKNOWN\"\nif [ \"$KERNEL_VERSION_STATUS\" == \"MEETS_MINIMUM\" ] && [ \"$COPY_FAIL_STATUS\" != \"STILL_VULNERABLE\" ] && [ \"$DIRTY_FRAG_STATUS\" == \"FIXED\" ]; then\n    OVERALL_STATUS=\"FULLY_REMEDIATED\"\nelif [ \"$KERNEL_VERSION_STATUS\" == \"MEETS_MINIMUM\" ] && [ \"$COPY_FAIL_STATUS\" == \"MITIGATED\" ]; then\n    OVERALL_STATUS=\"MITIGATED\"\nelse\n    OVERALL_STATUS=\"NOT_REMEDIATED\"\nfi\n\n# Create post-reboot results\ncat > \"/tmp/${HOSTNAME}-post-reboot-verification.json\" </dev/null\n\n# Remove this script so it only runs once\nrm -f /var/lib/cloud/scripts/per-boot/verify-kernel-patch.sh\nVERIFY_EOF\n\nchmod +x /var/lib/cloud/scripts/per-boot/verify-kernel-patch.sh\nlog \"Post-reboot verification script created\"\n\nif [ \"$AUTO_REBOOT\" == \"yes\" ]; then\n    echo -e \"${YELLOW}AUTOMATIC REBOOT IN 10 SECONDS${NC}\"\n    echo \"\"\n    echo \"The system will reboot automatically in 10 seconds to load the new kernel.\"\n    echo \"Post-reboot verification will run automatically.\"\n    echo \"Results will be uploaded to s3://$S3_BUCKET/$RESULTS_PREFIX/\"\n    echo \"\"\n    log \"Scheduling automatic reboot in 10 seconds\"\n\n    sleep 10\n    log \"Initiating system reboot\"\n    echo \"Rebooting now...\"\n    reboot\nelse\n    echo -e \"${YELLOW}REBOOT REQUIRED${NC}\"\n    echo \"\"\n    echo \"The kernel has been updated. Please reboot to load the new kernel.\"\n    echo \"Post-reboot verification will run automatically after reboot.\"\n    echo \"\"\n    log \"Kernel patching completed - manual reboot required\"\nfi\n\nexit 0\n", "creation_timestamp": "2026-05-19T20:24:34.000000Z"}