Copy Fail 2: Linux Kernel Local Privilege Escalation Vulnerability

Impacted Products

• CubeCOS

Introduction

This advisory covers Copy Fail 2: electric boogaloo

A critical vulnerability has been identified in the Linux Kernel’s Crypto User Configuration Interface (CONFIG_CRYPTO_USER_API), specifically impacting the AF_ALG socket family utilized by the kernel crypto API. This vulnerability is present in kernels used within CubeCOS 3.1.0 and older.
While the core kernel is affected, CubeCOS’s rigid architectural isolation and hardened access controls provide a significant barrier against the exploitability of this flaw in standard production environments.

Description

The vulnerability, dubbed "Copy Fail 2," involves a memory corruption flaw during specific socket system calls within the AF_ALG address family. Unlike the previous iteration, this flaw allows for potential memory disclosure or local privilege escalation.

• Persistence: Because CONFIG_CRYPTO_USER_API is compiled directly into the CubeCOS kernel 6.12.74-1.el9, the socket system call cannot be disabled via standard module blacklisting (e.g., modprobe).
• Mitigation Limits: Standard SELinux enforcement and kernel boot parameters are insufficient to fully neutralize the API surface without a kernel-level patch.

Risk Assessment & Exposure

The actual risk to CubeCOS deployments is lowered by the Zero Trust architecture of the platform:

• Restricted Access Control: CubeCOS does not permit general user access. System access is strictly limited to:
• Root Account: Reserved exclusively for authorized support engineers.
• Admin (CLI) Account: Restricted to a Command Line Interface (CLI) providing a menu of pre-tested, limited-scope operations.
• Network Isolation: Access to the management interfaces (SSH) is only possible via physical presence or a dedicated management network protected by a VPN.
• Inter-Node Security: Internal communication between nodes is secured via SSH public/private key pairs, preventing unauthorized lateral movement via the crypto API.

Customer Actions Required

Immediate Short-Term Mitigations

To minimize the attack surface until a patch is applied, administrators should adhere to the following:

1. Disable Scripting of Alert Response: While alert response can respond to events using scripts within containers, this feature bypasses certain CLI restrictions. It is strongly recommended that this feature remain disabled to prevent potential local privilege escalation attempts.
2. Network Hardening: Ensure the management network remains strictly isolated and that VPN access is audited.
3. Log monitoring: CubeCOS provides aspects rich metrics and logging mechanisms. Privilege escalation such as su should be closely audited.

Permanent Long-Term Mitigation

The vulnerability is addressed through a kernel update.

• Resolution: The fix will be included in an upcoming security patch. Customers will be notified when it is available.
• Fix: These versions include a patched kernel that resolves the underlying AF_ALG socket handling issues.

Virtual Machine (Guest OS) Recommendations

While CubeCOS provides a secure foundation for the cloud platform, the security of individual Virtual Machines (VMs) remains a shared responsibility.

• Vulnerability Scanning: Tenants are strongly encouraged to perform internal audits of their VM workloads. If a VM's Guest OS utilizes a kernel version vulnerable to Copy Fail 2, it may be susceptible to local privilege escalation or denial-of-service attacks from within the VM itself.
• Patching: Ensure that all Linux-based VMs are updated to their respective distribution's latest stable kernel.
• Configuration: Where possible, restrict access to raw socket calls within the Guest OS if the application layer does not require them.

Deployment Schedule

A fix is currently under development. Customers will be notified via the standard release channel once the update is available for download and installation.

Note: For systems that cannot be immediately rebooted or updated, maintaining the "Short-Term Mitigations" listed above provides a robust defense-in-depth posture that makes exploitation highly improbable.

References

List

• https://nvd.nist.gov/vuln/detail/CVE-2026-31431
• https://access.redhat.com/security/cve/cve-2026-31431

Change Log

Contact Us