Last active
April 30, 2026 04:11
-
-
Save cr0nx/3079c57310f01ad89699bda642e0e37e to your computer and use it in GitHub Desktop.
Tetragon Tracing Policy - copy-fail-aead-recvmsg-kill - CVE-2026-31431 PREVENTION: Kill unprivileged aead_recvmsg
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: cilium.io/v1alpha1 | |
| kind: TracingPolicy | |
| metadata: | |
| name: copy-fail-aead-recvmsg-kill | |
| annotations: | |
| description: "CVE-2026-31431 PREVENTION: Kill unprivileged aead_recvmsg" | |
| spec: | |
| kprobes: | |
| - call: "aead_recvmsg" | |
| syscall: false | |
| selectors: | |
| - matchCapabilities: | |
| - type: Effective | |
| isNamespaceCapability: false | |
| operator: "NotIn" | |
| values: | |
| - "CAP_NET_ADMIN" | |
| matchBinaries: | |
| - operator: "NotIn" | |
| values: | |
| - "/usr/sbin/charon" | |
| - "/usr/sbin/racoon" | |
| - "/usr/sbin/pluto" | |
| matchActions: | |
| - action: Sigkill |
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Check out more Linux Red vs. Blue hands-on content here: https://edu.defensive-security.com