Уведомление об уязвимости Copy Fail CVE-2026-31431

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cve-2026-31431-mitigation
  namespace: kube-system
  labels:
    app: cve-2026-31431-mitigation
    security: security-mitigation
spec:
  selector:
    matchLabels:
      name: cve-2026-31431-mitigation
  template:
    metadata:
      labels:
        name: cve-2026-31431-mitigation
    spec:
      hostPID: true
      hostNetwork: true
      initContainers:
      - name: apply-mitigation
        image: emk8s.cr.cloud.ru/ubuntu:22.04
        securityContext:
          privileged: true
        volumeMounts:
        - name: host-root
          mountPath: /host
        command: ["/bin/bash", "-c"]
        args:
          - |
            set -euo pipefail

            MODULE="algif_aead"
            HOST="chroot /host"

            echo "--- Step 1: Blacklisting $MODULE ---"
            if ! grep -qs "algif_aead" /host/etc/modprobe.d/*.conf 2>/dev/null; then
              printf "install $MODULE /bin/false\nblacklist $MODULE\n" > /host/etc/modprobe.d/disable-$MODULE.conf
                echo "✓ Created modprobe config to block algif_aead"
              else
                echo "✓ Mitigation already present in modprobe config"
              fi

            echo "--- Step 2: Checking if $MODULE is loaded (lsmod) ---"
            if $HOST lsmod | grep -q "^$MODULE"; then
                echo "Module is loaded. Attempting to unload..."

                if $HOST modprobe -r $MODULE 2>/dev/null; then
                    echo "✓ Success: Module unloaded gracefully."
                else
                    echo "✗ Module is busy. Searching for processes using AF_ALG sockets..."

                    PIDS=$($HOST ss -xp | grep "af_alg" | grep -oP 'pid=\K[0-9]+' | sort -u || true)

                    if [ -z "$PIDS" ]; then
                        echo "✗ No specific PIDs found, but module is busy. Manual intervention or reboot may be needed."
                    else
                        echo "Killing processes: $PIDS"
                        $HOST kill -9 $PIDS || true
                        sleep 2
                    fi

                    if $HOST modprobe -r $MODULE 2>/dev/null; then
                        echo "✅ Success: Module unloaded after killing processes."
                    else
                        echo "⚠️ ERROR: Failed to unload $MODULE even after cleanup."
                    fi
                fi
            else
                echo "✅ Module $MODULE is not loaded. Node is clean."
            fi

      containers:
      - name: monitoring-agent
        image: emk8s.cr.cloud.ru/ubuntu:22.04
        securityContext:
          privileged: true
        resources:
          requests:
            cpu: 10m
            memory: 16Mi
          limits:
            memory: 32Mi
        command: ["/bin/bash", "-c"]
        args:
          - |
            while true; do
              if grep -q "^algif_aead " /proc/modules; then
                echo "$(date): ⚠️ ALERT! Module algif_aead LOADED!"
                chroot /host modprobe -r algif_aead || echo "✗ Cannot unload live."
              fi
              sleep 3600
            done
      volumes:
      - name: host-root
        hostPath:
          path: /
          type: Directory