[Venis33]

Stiglo je sledeće obaveštenje od provajdera na e-poštu. Zvuči da nije previše relevantno ako se ne vrte kontejneri na hostu ili serveru, ali svakako ne škodi onemogućiti viškove od modula.

Security Notice - CVE-2026-31431: Analysis, Scope, and Remediation Plan
Hello,

This is an informational notice regarding CVE-2026-31431, known as "Copy Fail". It
represents one of the most widespread Linux kernel vulnerabilities in recent years, with
a potential impact on the global Linux ecosystem. This flaw was reported on April 29,
2026.

Our security team acknowledged this disclosure on the day of its publication and
immediately initiated the necessary investigations.

This flaw, located in the kernel's cryptographic subsystem (via the AF_ALG interface),
allows for a Local Privilege Escalation (LPE). On a standard server, it allows a standard
user to become root (administrator). Within a containerized environment (such as
Docker or Kubernetes), it enables a container escape to take control of the host node.

As the security of your infrastructure is our priority, here are the details regarding the
impact of this vulnerability on your Scaleway services and the recommendations to
follow.

Actions Taken by Scaleway
Upon the disclosure of this vulnerability, our teams took the necessary measures to
secure environments and provide clean images:

On Kubernetes Kapsule: New OS images disabling the algif_aead module
have been deployed: Any new node created after April 30, 2026, at 14:20 CEST
will automatically use a mitigated version. (You can check the release date of the
version being used in the OS-IMAGE field returned by kubectl get node -o
wide).

Risk Assessment: Multi-tenant Context vs. Isolated Environment

The urgency to apply patches strongly depends on your usage patterns and the
architecture of your services:

Multi-tenant / Shared Environment (High Severity): If your machines or Kapsule
clusters host applications from different clients, provide shell access to multiple
users, or execute unverified third-party code, this vulnerability is critical. An
attacker with limited access (standard user or pod access) can exploit this flaw
to gain full control of the server (root access) and compromise the data of other
tenants on the system.

Single-tenant / Isolated Environment (Moderate Severity): If your servers or
clusters are strictly dedicated to your own use and only run trusted applications
for which you control the code (without local access or arbitrary execution
possible by third parties), the risk is significantly lower. The vulnerability indeed
requires prior local code execution to be exploited.

Required Actions and Temporary Mitigation

The permanent solution is to update your systems' kernel once a version including the
patch is available. We invite you to regularly check for the patch availability for your
specific OS.

Mitigation Measure (Workaround):

If an immediate reboot or update is not possible, you can apply a temporary mitigation
directly on your affected nodes and servers to block the vulnerable interface. Execute
the following commands with administrator privileges (root or sudo):

Code:

# Create a rule to prevent their automatic reloading echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf # Unload the vulnerable module from memory rmmod algif_aead 2>/dev/null || true

For servers based on RedHat / CentOS / AlmaLinux / RockyLinux:

Code:

# Create a rule to prevent the module from loading automatically on boot grubby --update-kernel=ALL --args=initcall_blacklist=algif_aead_init # Completely reboot the system to apply the modification

For Kubernetes Kapsule, this operation must be performed on the worker nodes, for
example via SSH access or by deploying a privileged DaemonSet:

Code:

apiVersion: apps/v1 kind: DaemonSet metadata: name: disable-algif-aead namespace: kube-system labels: app: disable-algif-aead spec: selector: matchLabels: app: disable-algif-aead template: metadata: labels: app: disable-algif-aead spec: hostPID: true tolerations: - operator: Exists effect: NoSchedule - operator: Exists effect: NoExecute initContainers: - name: disable-algif-aead image: alpine:3.23 securityContext: privileged: true command: - /bin/sh - -c - | echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf rmmod algif_aead 2>/dev/null || true volumeMounts: - name: modprobe-d mountPath: /etc/modprobe.d containers: - name: pause image: registry.k8s.io/pause:3.10 resources:

[VincaSec]