News for hackers. Stuff that matters.

A comment on Copy Fail – CVE-2026-31431. Parent comment

Re:Copy Fail – CVE-2026-31431 by nromiun on Thursday April 30, 2026 @01:10AM (#47958393)
To even get the su binary on Android you have to patch the OS. So this exploit can't work on Android. Because there is no su binary to target.

Update: Just tried it on Termux and as expected even creating an AF_ALG socket requires root access.

[ Parent | on HN ]
Re:Copy Fail – CVE-2026-31431 by staticassertion on Thursday April 30, 2026 @05:12AM (#47960011)
The specific exploit payload for the POC relies on a su binary. The vuln is ambivalent and other non-su paths will exist.
[ Parent | on HN ]
Re:Copy Fail – CVE-2026-31431 by nromiun on Thursday April 30, 2026 @09:35AM (#47962224)
Of course, but it does not matter as the entire AF_ALG module is forbidden by SELinux anyway (on Android).
[ Parent | on HN ]
Re:Copy Fail – CVE-2026-31431 by staticassertion on Thursday April 30, 2026 @11:08AM (#47963684)
That's fine and a very separate reason why it would not be exploitable, also assuming that the module is not just compiled in since then loading it would be irrelevant.
[ Parent | on HN ]