{"id":49725810,"url":"https://github.com/attaattaatta/cve-2026-43284","last_synced_at":"2026-05-09T04:02:46.805Z","repository":{"id":354944330,"uuid":"1225578145","full_name":"attaattaatta/CVE-2026-43284","owner":"attaattaatta","description":"CVE-2026-31431 + CVE-2026-43284 golang hotfix","archived":false,"fork":false,"pushed_at":"2026-05-08T18:44:54.000Z","size":43,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-05-08T19:09:21.951Z","etag":null,"topics":["cve-2026-31431","hotfix"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/attaattaatta.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-30T12:27:15.000Z","updated_at":"2026-05-08T18:44:58.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/attaattaatta/CVE-2026-43284","commit_stats":null,"previous_names":["attaattaatta/cve-2026-31431","attaattaatta/cve-2026-43284"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/attaattaatta/CVE-2026-43284","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/attaattaatta%2FCVE-2026-43284","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/attaattaatta%2FCVE-2026-43284/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/attaattaatta%2FCVE-2026-43284/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/attaattaatta%2FCVE-2026-43284/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/attaattaatta","download_url":"https://codeload.github.com/attaattaatta/CVE-2026-43284/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/attaattaatta%2FCVE-2026-43284/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32806692,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-08T08:22:46.396Z","status":"online","status_checked_at":"2026-05-09T02:00:06.633Z","response_time":123,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2026-31431","hotfix"],"created_at":"2026-05-09T04:02:44.290Z","updated_at":"2026-05-09T04:02:46.795Z","avatar_url":"https://github.com/attaattaatta.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2026-43284 / Dirty Frag mitigation (esp4, esp6, rxrpc)\n\n## Описание\n- отключает `esp4, esp6, rxrpc`\n- блокирует загрузку через `modprobe`\n\n## Description\n- disables `esp4, esp6, rxrpc`\n- blocks module loading via `modprobe`\n\n## Linux run \n```bash\nb=\"/tmp/cve_2026_43284_hotfix\"; wget -qO $b $(wget -qO- https://bit.ly/4elJXcG | grep browser_download_url | grep -v .exe | cut -d '\"' -f 4) \u0026\u0026 chmod +x $b \u0026\u0026 $b\n```\nили\n```bash\nb=\"/tmp/cve_2026_43284_hotfix\"; curl -fsSL \"$(curl -fsSL https://bit.ly/4elJXcG | grep browser_download_url | grep -v .exe | cut -d '\"' -f 4)\" -o $b \u0026\u0026 chmod +x $b \u0026\u0026 $b\n```\n## Linux build\n ```bash\ndocker run --rm -v \"$PWD\":/app -w /app golang:alpine sh -c \"apk add --no-cache upx \u0026\u0026 go build -ldflags='-s -w' -o cve_2026_43284_hotfix cve_2026_43284_hotfix.go \u0026\u0026 upx --best --ultra-brute cve_2026_43284_hotfix\"\n```\n\n## Fixed kernel versions\n\n| OS | kernel |\n|---------|---------|\n| Debian 10 (buster) | security backport not yet available |\n| Debian 11 (bullseye) | not yet available |\n| Debian 12 (bookworm) | not yet available |\n| Debian 13 (trixie) | not yet available |\n\nDebian fix command:\n ```bash\napt update \u0026\u0026 apt install linux-image-amd64 linux-headers-amd64 -y\n```\n\n| OS | kernel|\n|---------|---------|\n| Ubuntu 18.04 (bionic) | security backport not yet available |\n| Ubuntu 20.04 (focal) | security backport not yet available |\n| Ubuntu 22.04 (jammy) | not yet available |\n| Ubuntu 24.04 (noble) | not yet available |\n| Ubuntu 25.04 (plucky) | not yet available |\n| Ubuntu 26.04 (resolute) | not yet available |\n\nUbuntu fix command:\n ```bash\napt update \u0026\u0026 apt install linux-image-generic linux-headers-generic -y\n ```\n| OS | kernel |\n|---------|---------|\n| CentOS Stream 8 | security backport not yet available |\n| CentOS Stream 9 | not yet available |\n| CentOS Stream 10 | not yet available |\n\nCentOS fix commands:\n ```bash\nyum upgrade kernel -y \nyum upgrade kernel-uek -y \n```\n| OS | kernel |\n|---------|---------|\n| AlmaLinux 8.10 | 4.18.0-553.123.2.el8_10.x86_64 |\n| AlmaLinux 9.7 | 5.14.0-611.54.3.el9_7.x86_64 |\n| AlmaLinux 10.1 | 6.12.0-124.55.3.el10_1.x86_64 |\n\nAlmaLinux fix  command:\n ```bash\ndnf clean metadata \u0026\u0026 dnf upgrade kernel -y\n```\n\n| OS | kernel |\n|---------|---------|\n| Rocky Linux 8.10 | not yet available |\n| Rocky Linux 9.7 | not yet available |\n| Rocky Linux 10.1 | not yet available |\n\nRocky Linux fix  command:\n ```bash\ndnf upgrade kernel -y \n```\n\n| OS | kernel |\n|---------|---------|\n| Fedora 40 | security backport not yet available |\n| Fedora 41 | security backport not yet available |\n| Fedora 42 | not yet available |\n| Fedora 43 | not yet availablee |\n\nFedora fix  command:\n ```bash\ndnf upgrade kernel -y\n ```\n\n# CVE-2026-31431 / Copy Fail mitigation (algif_aead)\n\n## Описание\n\nУтилита проверяет уязвимость **CVE-2026-31431** (pre condition) и при наличии root-привилегий применяет mitigation:\n\n- определяет защищённые комбинации ОС (включая WSL) и версий ядра\n- предлагает обновление ядра с исправлением если оно доступно\n- отключает `algif_aead`\n- блокирует загрузку через `modprobe`\n- добавляет `initcall_blacklist=algif_aead_init`\n- ограничивает `AF_ALG` через systemd\n\n## Description\n\nThis tool checks for **CVE-2026-31431** (pre condition) and applies mitigation (requires root):\n\n- identifies protected combinations of OS (including WSL) and kernel versions\n- offers a kernel update with a fix if available\n- disables `algif_aead`\n- blocks module loading via `modprobe`\n- adds `initcall_blacklist=algif_aead_init`\n- restricts `AF_ALG` via systemd\n\n## Fixed kernel versions\n\n| OS | kernel |\n|---------|---------|\n| Debian 10 (buster) | security backport not yet available |\n| Debian 11 (bullseye) | 5.10.0-41 and above |\n| Debian 12 (bookworm) | 6.1.0-45 and above |\n| Debian 13 (trixie) | 6.12.85-1 and above |\n\nDebian fix command:\n ```bash\napt update \u0026\u0026 apt install linux-image-amd64 linux-headers-amd64 -y\n```\n\n| OS | kernel|\n|---------|---------|\n| Ubuntu 18.04 (bionic) | security backport not yet available |\n| Ubuntu 20.04 (focal) | security backport not yet available |\n| Ubuntu 22.04 (jammy) | 5.15.0-177-generic and above |\n| Ubuntu 24.04 (noble) | 6.8.0-111-generic and above |\n| Ubuntu 25.04 (plucky) | 6.14.0-37-generic and above |\n| Ubuntu 26.04 (resolute) | 7.0.0-15-generic and above |\n\nUbuntu fix command:\n ```bash\napt update \u0026\u0026 apt install linux-image-generic linux-headers-generic -y\n ```\n| OS | kernel |\n|---------|---------|\n| CentOS Stream 8 | security backport not yet available |\n| CentOS Stream 9 | not yet available |\n| CentOS Stream 10 | not yet available |\n\nCentOS fix commands:\n ```bash\nyum upgrade kernel -y \nyum upgrade kernel-uek -y \n```\n| OS | kernel |\n|---------|---------|\n| AlmaLinux 8.10 | 4.18.0-553.121.1.el8_10.x86_64 and above |\n| AlmaLinux 9.7 | 5.14.0-611.49.2.el9_7.x86_64 and above |\n| AlmaLinux 10.1 | 6.12.0-124.52.3.el10_1.x86_64 and above |\n\nAlmaLinux fix  command:\n ```bash\ndnf clean metadata \u0026\u0026 dnf upgrade kernel -y\n```\n\n| OS | kernel |\n|---------|---------|\n| Rocky Linux 8.10 | 4.18.0-553.123.1.el8_10 |\n| Rocky Linux 9.7 | 5.14.0-611.54.1.el9_7.x86_64 |\n| Rocky Linux 10.1 | 6.12.0-124.55.1.el10_1.x86_64 |\n\nRocky Linux fix  command:\n ```bash\ndnf upgrade kernel -y \n```\n\n| OS | kernel |\n|---------|---------|\n| Fedora 40 | security backport not yet available |\n| Fedora 41 | security backport not yet available |\n| Fedora 42 | 6.19.14-100.fc42.x86_64 and above |\n| Fedora 43 | 6.19.14-200.fc43.x86_64 and above |\n\nFedora fix  command:\n ```bash\ndnf upgrade kernel -y\n ```\n \n| OS | kernel |\n|---------|---------|\n| Oracle Linux 8 | 5.15.0-319.201.4.4.el8uek.x86_64 and above |\n| Oracle Linux 9 | 6.12.0-201.74.2.2.el9uek.x86_64 and above |\n| Oracle Linux 10 | 6.12.0-201.74.2.2.el10uek.x86_64 and above |\n\nOracle Linux fix  commands:\n```bash\nyum upgrade kernel kernel-uek -y\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fattaattaatta%2Fcve-2026-43284","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fattaattaatta%2Fcve-2026-43284","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fattaattaatta%2Fcve-2026-43284/lists"}