Container Service for Kubernetes:Security advisory: CVE-2026-31431

Prérequis

Avant de commencer, vérifiez les points suivants :

• Vos charges de travail ne dépendent pas du module noyau AF_ALG (utilisé pour l'accélération cryptographique dans l'espace noyau, telle que IPsec ou libkcapi).

• Aucun autre profil seccomp de type Localhost n'est configuré dans le champ securityContext.seccompProfile des Pods de vos charges de travail.

1. Déployer le DaemonSet seccomp

Ce DaemonSet écrit un fichier de politique seccomp sur chaque nœud Linux de votre cluster. Une fois le fichier créé, appliquez la politique en la référençant dans les Pods de vos charges de travail, comme décrit à l'étape 2.

1. Enregistrez le manifeste YAML suivant sous le nom seccomp-block-AF_ALG.yaml .

   Le DaemonSet écrit le fichier seccomp-block-af_alg.json dans le répertoire /var/lib/kubelet/seccomp/profiles/ sur tous les nœuds Linux.

   YAML

   apiVersion: apps/v1
   kind: DaemonSet
   metadata:
     name: ack-cve-2026-31431-mitigate
     namespace: kube-system
     labels:
       app: ack-cve-2026-31431-mitigate
   spec:
     selector:
       matchLabels:
         app: ack-cve-2026-31431-mitigate
     template:
       metadata:
         labels:
           app: ack-cve-2026-31431-mitigate
       spec:
         priorityClassName: system-node-critical
         nodeSelector:
           kubernetes.io/os: linux
         tolerations:
           - operator: Exists
         containers:
           - name: mitigate
             image: registry-cn-hangzhou.ack.aliyuncs.com/acs/busybox:1.35
             command:
               - /bin/sh
               - -c
               - |
                 echo "=== CVE-2026-31431 Mitigation ==="
   
                 cat <<EOF > /kubelet-seccomp/seccomp-block-af_alg.json
                 {
                   "defaultAction": "SCMP_ACT_ERRNO",
                   "architectures": [
                     "SCMP_ARCH_X86_64",
                     "SCMP_ARCH_X86",
                     "SCMP_ARCH_X32",
                     "SCMP_ARCH_AARCH64",
                     "SCMP_ARCH_ARM"
                   ],
                   "syscalls": [
                     {
                       "names": ["socket"],
                       "action": "SCMP_ACT_ERRNO",
                       "args": [
                         {
                           "index": 0,
                           "value": 38,
                           "op": "SCMP_CMP_EQ"
                         }
                       ]
                     },
                     {
                       "names": ["socket"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [
                         {
                           "index": 0,
                           "value": 40,
                           "op": "SCMP_CMP_NE"
                         }
                       ]
                     },
                     {
                       "names": [
                         "accept", "accept4", "access", "adjtimex", "alarm", "bind", "brk",
                         "cachestat", "capget", "capset", "chdir", "chmod", "chown", "chown32",
                         "clock_adjtime", "clock_adjtime64", "clock_getres", "clock_getres_time64",
                         "clock_gettime", "clock_gettime64", "clock_nanosleep", "clock_nanosleep_time64",
                         "close", "close_range", "connect", "copy_file_range", "creat",
                         "dup", "dup2", "dup3",
                         "epoll_create", "epoll_create1", "epoll_ctl", "epoll_ctl_old",
                         "epoll_pwait", "epoll_pwait2", "epoll_wait", "epoll_wait_old",
                         "eventfd", "eventfd2", "execve", "execveat", "exit", "exit_group",
                         "faccessat", "faccessat2", "fadvise64", "fadvise64_64", "fallocate",
                         "fanotify_mark", "fchdir", "fchmod", "fchmodat", "fchmodat2",
                         "fchown", "fchown32", "fchownat", "fcntl", "fcntl64", "fdatasync",
                         "fgetxattr", "flistxattr", "flock", "fork", "fremovexattr", "fsetxattr",
                         "fstat", "fstat64", "fstatat64", "fstatfs", "fstatfs64", "fsync",
                         "ftruncate", "ftruncate64",
                         "futex", "futex_requeue", "futex_time64", "futex_wait", "futex_waitv", "futex_wake",
                         "futimesat", "getcpu", "getcwd", "getdents", "getdents64",
                         "getegid", "getegid32", "geteuid", "geteuid32",
                         "getgid", "getgid32", "getgroups", "getgroups32", "getitimer",
                         "getpeername", "getpgid", "getpgrp", "getpid", "getppid", "getpriority",
                         "getrandom", "getresgid", "getresgid32", "getresuid", "getresuid32",
                         "getrlimit", "get_robust_list", "getrusage", "getsid", "getsockname",
                         "getsockopt", "get_thread_area", "gettid", "gettimeofday",
                         "getuid", "getuid32", "getxattr", "getxattrat",
                         "inotify_add_watch", "inotify_init", "inotify_init1", "inotify_rm_watch",
                         "io_cancel", "ioctl", "io_destroy", "io_getevents",
                         "io_pgetevents", "io_pgetevents_time64", "ioprio_get", "ioprio_set",
                         "io_setup", "io_submit", "ipc", "kill",
                         "landlock_add_rule", "landlock_create_ruleset", "landlock_restrict_self",
                         "lchown", "lchown32", "lgetxattr", "link", "linkat", "listen",
                         "listmount", "listxattr", "listxattrat", "llistxattr", "_llseek",
                         "lremovexattr", "lseek", "lsetxattr",
                         "lsm_get_self_attr", "lsm_list_modules", "lsm_set_self_attr",
                         "lstat", "lstat64", "madvise", "membarrier", "memfd_create", "memfd_secret",
                         "mincore", "mkdir", "mkdirat", "mknod", "mknodat",
                         "mlock", "mlock2", "mlockall", "map_shadow_stack",
                         "mmap", "mmap2", "mprotect",
                         "mq_getsetattr", "mq_notify", "mq_open",
                         "mq_timedreceive", "mq_timedreceive_time64",
                         "mq_timedsend", "mq_timedsend_time64", "mq_unlink",
                         "mremap", "mseal", "msgctl", "msgget", "msgrcv", "msgsnd", "msync",
                         "munlock", "munlockall", "munmap",
                         "name_to_handle_at", "nanosleep", "newfstatat", "_newselect",
                         "open", "openat", "openat2", "pause",
                         "pidfd_open", "pidfd_send_signal", "pipe", "pipe2",
                         "pkey_alloc", "pkey_free", "pkey_mprotect",
                         "poll", "ppoll", "ppoll_time64", "prctl",
                         "pread64", "preadv", "preadv2", "prlimit64",
                         "process_mrelease", "pselect6", "pselect6_time64",
                         "pwrite64", "pwritev", "pwritev2",
                         "read", "readahead", "readlink", "readlinkat", "readv",
                         "recv", "recvfrom", "recvmmsg", "recvmmsg_time64", "recvmsg",
                         "remap_file_pages", "removexattr", "removexattrat",
                         "rename", "renameat", "renameat2", "restart_syscall", "rmdir", "rseq",
                         "rt_sigaction", "rt_sigpending", "rt_sigprocmask", "rt_sigqueueinfo",
                         "rt_sigreturn", "rt_sigsuspend", "rt_sigtimedwait", "rt_sigtimedwait_time64",
                         "rt_tgsigqueueinfo",
                         "sched_getaffinity", "sched_getattr", "sched_getparam",
                         "sched_get_priority_max", "sched_get_priority_min", "sched_getscheduler",
                         "sched_rr_get_interval", "sched_rr_get_interval_time64",
                         "sched_setaffinity", "sched_setattr", "sched_setparam",
                         "sched_setscheduler", "sched_yield", "seccomp", "select",
                         "semctl", "semget", "semop", "semtimedop", "semtimedop_time64",
                         "send", "sendfile", "sendfile64", "sendmmsg", "sendmsg", "sendto",
                         "setfsgid", "setfsgid32", "setfsuid", "setfsuid32",
                         "setgid", "setgid32", "setgroups", "setgroups32", "setitimer", "setpgid",
                         "setpriority", "setregid", "setregid32", "setresgid", "setresgid32",
                         "setresuid", "setresuid32", "setreuid", "setreuid32", "setrlimit",
                         "set_robust_list", "setsid", "setsockopt", "set_thread_area",
                         "set_tid_address", "setuid", "setuid32", "setxattr", "setxattrat",
                         "shmat", "shmctl", "shmdt", "shmget", "shutdown",
                         "sigaltstack", "signalfd", "signalfd4", "sigprocmask", "sigreturn",
                         "socketcall", "socketpair", "splice",
                         "stat", "stat64", "statfs", "statfs64", "statmount", "statx",
                         "symlink", "symlinkat", "sync", "sync_file_range", "syncfs", "sysinfo",
                         "tee", "tgkill", "time",
                         "timer_create", "timer_delete", "timer_getoverrun",
                         "timer_gettime", "timer_gettime64", "timer_settime", "timer_settime64",
                         "timerfd_create", "timerfd_gettime", "timerfd_gettime64",
                         "timerfd_settime", "timerfd_settime64",
                         "times", "tkill", "truncate", "truncate64", "ugetrlimit", "umask",
                         "uname", "unlink", "unlinkat", "uretprobe",
                         "utime", "utimensat", "utimensat_time64", "utimes",
                         "vfork", "vmsplice", "wait4", "waitid", "waitpid", "write", "writev",
                         "bpf", "chroot", "clone3", "fanotify_init", "fsconfig", "fsmount",
                         "fsopen", "fspick", "get_mempolicy", "io_uring_enter", "io_uring_register",
                         "io_uring_setup", "iopl", "ioperm", "kcmp", "keyctl", "add_key",
                         "request_key", "lookup_dcookie", "mbind", "migrate_pages", "mount",
                         "mount_setattr", "move_mount", "umount2", "move_pages", "nfsservctl",
                         "open_tree", "perf_event_open", "pidfd_getfd", "pivot_root",
                         "process_vm_readv", "process_vm_writev", "ptrace", "quotactl",
                         "quotactl_fd", "reboot", "set_mempolicy", "set_mempolicy_home_node",
                         "setdomainname", "sethostname", "setns", "swapon", "swapoff",
                         "syslog", "unshare", "userfaultfd", "vhangup"
                       ],
                       "action": "SCMP_ACT_ALLOW"
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 0, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 8, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 131072, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 131080, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 4294967295, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["clone"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 2114060288, "op": "SCMP_CMP_MASKED_EQ", "valueTwo": 0 }]
                     },
                     {
                       "names": ["arch_prctl"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 4114, "op": "SCMP_CMP_NE" }]
                     }
                   ]
                 }
   
                 EOF
   
                 echo "=== Mitigation complete. Ensure your Pod's securityContext is configured to use this seccomp profile (type: Localhost, localhostProfile: profiles/seccomp-block-af_alg.json). Sleeping to keep the DaemonSet running. ==="
                 sleep infinity
             resources:
               requests:
                 cpu: 10m
                 memory: 16Mi
               limits:
                 memory: 32Mi
             volumeMounts:
               - name: kubelet-seccomp-root
                 mountPath: /kubelet-seccomp
         volumes:
           - name: kubelet-seccomp-root
             hostPath:
               path: /var/lib/kubelet/seccomp/profiles
               type: DirectoryOrCreate

2. Appliquez le manifeste pour déployer le DaemonSet.

   kubectl apply -f seccomp-block-AF_ALG.yaml

3. Après le déploiement, vérifiez que le fichier de politique a bien été écrit sur chaque nœud.

   # Verify that the DaemonSet is ready on all nodes.
   kubectl -n kube-system get daemonset ack-cve-2026-31431-mitigate
   # Check the logs to confirm the policy was written. The output should include "Mitigation complete".
   kubectl -n kube-system logs -l app=ack-cve-2026-31431-mitigate --tail=3

2. Configurer un profil seccomp pour un Pod d'application

Le fichier de politique n'est pas appliqué automatiquement aux Pods. Référencez-le explicitement dans le contexte de sécurité (securityContext) de chaque Pod de charge de travail.

1. Configurez le profil seccomp .

   Dans le champ securityContext de votre Pod de charge de travail, définissez le type seccompProfile sur Localhost et utilisez localhostProfile pour spécifier le chemin relatif au répertoire racine seccomp du nœud (/var/lib/kubelet/seccomp ).

   securityContext:
     seccompProfile:
       type: Localhost
       localhostProfile: profiles/seccomp-block-af_alg.json

2. Après avoir appliqué les modifications, redémarrez les Pods de votre charge de travail.

3. Surveillez les Pods de la charge de travail pour confirmer leur bon fonctionnement :

   • Si les Pods démarrent correctement, le profil seccomp est actif et l'atténuation est en place.

   • Si les Pods ne parviennent pas à démarrer ou plantent, annulez immédiatement les modifications.