mahmoud halim
@mhalim3211 follower11 downloads47 copies3 likes2,366 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Platforms
1
MITRE Techniques
1
1
1
1
Detects exploitation of CVE-2026-31431 (Copy Fail), a logic flaw in the Linux kernel AF_ALG crypto interface
that allows an unprivileged user to overwrite the page cache of read-only files, including SUID binaries such
as /usr/bin/su, without holding write permissions.
By injecting a payload into the page cache of a SUID binary and executing it, an attacker gains root privileges.
that allows an unprivileged user to overwrite the page cache of read-only files, including SUID binaries such
as /usr/bin/su, without holding write permissions.
By injecting a payload into the page cache of a SUID binary and executing it, an attacker gains root privileges.
