CVE-2026-31431-mitigation-suite - A defensive security toolkit specifically engineer

项目说明

AF_ALG Defense Framework


A kernel-runtime defense framework for the Linux AF_ALG (Address Family
Algorithm, family 38) subsystem. Built for Security Operations Centers
running enterprise Linux fleets where Zero Trust must extend *into* the
kernel, not stop at the network edge.

Why AF_ALG matters to a SOC

AF_ALG exposes the kernel crypto API to userspace through a socket
interface (socket(AF_ALG, SOCK_SEQPACKET, 0)). It was originally added
for embedded systems without /de and has since accumulated a
disproportionate share of kernel C it presents kernel-mode
crypto code to unpri callers — a classic surface-area mismatch.

In a typical enterprise build:

Almost no userspace requires it. OpenSSL, GnuTLS, libsodium and

systemd-cryptsetup all use other paths by default.

Ad are interested in it. It is a recurring pivot in

pri chains (C, C, and others)
precisely because it is reachable from unpri containers when
user namespaces are a.

It is in to most EDRs. Endpoint tools that hook connect(),

bind(), or DNS see nothing — AF_ALG traffic ne the kernel.

This framework treats every AF_ALG socket creation as a high-signal
event and reduces the surface that makes those events exploitable.

Threat model and Zero Trust mapping

| Zero Trust principle | Control in this framework |
|--------------------------------|----------------------------------------------------------------------------|
| Ne, always | eBPF tracer logs every AF_ALG socket-create attempt with pid/uid/comm |
| Assume breach | Crypto auditor diffs kernel posture against a signed baseline |
| Least pri | systemd RestrictAddressFamilies + capability bounding on managed units |
| Microsegmentation (kernel-side)| unpri=0 removes the userns pivot used by exploits |
| Continuous | CI audit reports against a schema on every change |

Repository layout

Components

1. Runtime obser — eBPF tracer

ebpf/af_alg_tracer.py attaches a kprobe to security_socket_create.
The probe filters on family == 38 at the BPF program level so the
prunes unrelated socket creations and the per-event o
stays in nanoseconds. It emits one JSON record per attempt:

Pipe stdout into , Fluent Bit, or journald (via systemd-cat).
A comm-name allowlist (/etc/af-alg-defense/allow.list) suppresses
known-good consumers without losing the ability to detect de.

The kprobe target is the LSM hook, so events fire on intent —
e that would be denied by seccomp or RestrictAddressFamilies
still produce a record. That is exactly what a SOC wants for beha
baselining.

2. Configuration as Code — Ansible role + systemd drop-in

ansible/roles/af_alg_hardening/ applies two hardening layers:

Sysctl drop-in (/etc/sysctl.d/90-af-alg-defense.conf):

kernel.unpri=0 — removes the userns pivot used

by most AF_ALG escalation chains.

user.max_user_namespaces=0 — distro-portable defence-in-depth.

Systemd drop-in (/etc/systemd/system/<unit>.d/50-af-alg-restrict.conf):
Uses RestrictAddressFamilies as an allow-list (not deny-list). The
unit is permitted AF_UNIX AF_INET AF_INET6 AF_NETLINK; any other
family — AF_ALG included — fails with EAFNOSUPPORT because systemd
enforces it through cgroup-attached BPF that the application cannot
disable. The drop-in also strips CAP_SYS_ADMIN and applies
ProtectKernel* to close the most common escalation paths.

Apply with:

For hosts without Ansible, drop the standalone file in place:

3. Kernel state auditor

auditor/crypto_auditor.py produces a JSON security-posture report by
inspecting:

/proc/crypto — every registered cipher / hash / aead, with

FIPS flags and self-test status.

/sys/module/ — loaded modules in the crypto subtree, with taint

flags and parameter snapshots.

/proc/sys/kernel/, /proc/sys/user/ — sysctls that gate AF_ALG

attack paths.

/sys/kernel/security/lockdown — kernel lockdown mode.

The report is keyed by stable finding IDs (FND-001 through FND-005
at present) so SIEM rules can suppress indi findings without
dropping the whole document. Drift detection compares posture against
a baseline:

The schema lives in schemas/audit_report.schema.json (Draft 2020-12)
and is in CI on every push.

4. Continuous Integration

.github/workflows/ci.yml runs four jobs on every push and PR:

1. ShellCheck — every *.sh and shebang-bearing script.
2. Schema — metaschema-checks audit_report.schema.json,
then runs the auditor live on the GH runner kernel and
the resulting report. Fixtures in tests/fixtures/ are also checked.
3. Python lint (ruff check .).
4. Ansible lint on the role tree.

A failed schema check blocks merges, which prevents downstream SIEM
parsers from breaking on a silently-renamed field.

Operational guidance for SOC

Detection rules to layer on top

Any af_alg_socket_create event from a non-allowlisted comm — page

on first occurrence, do not aggregate.

New entry in crypto_modules between consecuti runs on a

host where module loading should be frozen.

Any sysctl with hardened=false after a hardening playbook run —

indicates manual tampering or drift from a parallel config system.

lockdown field transitions from integrity/confidentiality to

none — strong indicator of kernel-state tampering.

Rollout plan (recommended)

1. Deploy the eBPF tracer in monitor-only mode for two weeks. Use
the resulting baseline to populate allow.list for known-good
consumers (cryptsetup at boot is the usual one).
2. Run the auditor against a representative host fleet; capture the
posture as the signed baseline.json.
3. Apply the Ansible role to a canary group with
af_alg_systemd_services set to one low-risk unit. Watch for
EAFNOSUPPORT errors in journald.
4. Expand the service list iteratively. systemd-analyze security
<unit> should show the restriction is enforced.
5. Wire the auditor into a nightly cron with --fail-on-drift and route
non-zero exits into the on-call queue.

What this framework does *not* do

It does not unload af_alg if it's already in use. Module unloading

is out of scope because legitimate boot-time consumers may still be
running. Use modprobe.blacklist=af_alg on the kernel command line
if you' nothing on the host needs it.

It does not patch CVEs. kernel updates remain the primary

control; this framework reduces the cost of a missed patch.

It does not protect against root. A local root can disable any of

these controls; the framework raises the bar to root, not past it.

Requirements

Linux ≥ 4.18 (for the security_socket_create kprobe target).

BCC ≥ 0.25 or libbpf ≥ 1.0, plus kernel headers matching uname -r.

Python 3.10+ on managed hosts.

Ansible 2.14+ on the control node.

CAP_BPF (or root) to load the tracer; read access to /proc/crypto

for the auditor (no pri required to read it).

License

Apache-2.0. See LICENSE.

项目信息

开发语言：Python

Star 数：4

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A defensive security toolkit specifically engineered to detect and mitigate CVE-2026-31431 and similar nftables / AF_ALG vulnerabilities. Includes non-destructive behavioral probes, module blacklisting automation, and Auditd/eBPF rules for real-time threat detection.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。