feat: add Copy Fail and Dirty Frag LPE fixes

src/modules/09-security/cve-fix.sh

@@ -266,23 +266,390 @@ security_cve_januscape_restore() {
     fi
 }
 
+# 通用：写入内核模块黑名单到 /etc/modprobe.d
+security_cve_module_blacklist() {
+    local conf_name="$1"
+    local conf_path="/etc/modprobe.d/${conf_name}.conf"
+    shift
+    local -a modules=("$@")
+
+    backup_file "$conf_path" 2>/dev/null || true
+    for mod in "${modules[@]}"; do
+        echo "install $mod /bin/false" >> "$conf_path"
+    done
+    log_success "已写入模块黑名单: $conf_path"
+}
+
+# 通用：移除内核模块黑名单配置文件
+security_cve_module_restore() {
+    local conf_name="$1"
+    local conf_path="/etc/modprobe.d/${conf_name}.conf"
+
+    if [[ ! -f "$conf_path" ]]; then
+        log_warn "未找到黑名单配置 $conf_path，无需还原"
+        return 0
+    fi
+    backup_file "$conf_path" 2>/dev/null || true
+    rm -f "$conf_path"
+    log_success "已移除模块黑名单: $conf_path"
+}
+
+# 通用：卸载内核模块并清理页面缓存
+security_cve_rmmod_and_drop_caches() {
+    local -a modules=("$@")
+    local has_mod=0
+
+    for mod in "${modules[@]}"; do
+        if lsmod 2>/dev/null | grep -q "^$mod "; then
+            rmmod "$mod" 2>/dev/null && log_info "已卸载模块: $mod" || log_warn "无法卸载模块: $mod (可能正在使用)"
+            has_mod=1
+        fi
+    done
+
+    echo 3 > /proc/sys/vm/drop_caches 2>/dev/null
+    log_info "页面缓存已清理"
+}
+
+# ============================================================
+# Copy Fail — Page-Cache Write LPE (algif_aead)
+# ============================================================
+
+security_cve_copyfail_detect() {
+    clear
+    show_menu_header "Copy Fail 漏洞检测 (LPE)"
+
+    echo -e "${CYAN}漏洞概述：${NC}"
+    echo "  Copy Fail 属于 Dirty Pipe/Dirty Frag 同类的 Page-Cache Write 漏洞"
+    echo "  通过 splice() + AF_ALG 实现在只读文件上写入任意数据"
+    echo "  危害等级：${RED}高危 (Local Privilege Escalation → root)${NC}"
+    echo "  影响范围：大多数主流 Linux 发行版"
+    echo "  利用模块：algif_aead"
+    echo "  参考链接：https://copy.fail"
+    echo "$UI_DIVIDER"
+
+    echo -e "${CYAN}模块检测：${NC}"
+
+    local found=0
+    if lsmod 2>/dev/null | grep -q '^algif_aead '; then
+        echo -e "  algif_aead: ${RED}已加载${NC} — 系统可能受 Copy Fail 影响"
+        found=1
+    elif modinfo algif_aead &>/dev/null; then
+        echo -e "  algif_aead: ${YELLOW}可用但未加载${NC} — 潜在风险"
+        found=1
+    else
+        echo -e "  algif_aead: ${GREEN}不可用${NC}"
+    fi
+
+    echo "$UI_DIVIDER"
+    if [[ "$found" -eq 1 ]]; then
+        echo -e "${RED}[警告] 检测到 Copy Fail 攻击面。注意：Dirty Frag 可绕过 Copy Fail 缓解措施！${NC}"
+        echo -e "${YELLOW}建议同时应用 Dirty Frag 修补以获得完整保护。${NC}"
+    else
+        echo -e "${GREEN}未检测到 Copy Fail 直接攻击面。${NC}"
+    fi
+    pause_function
+    return 0
+}
+
+security_cve_copyfail_mitigate() {
+    block_non_pve9_destructive "Copy Fail 修补" || return 1
+
+    clear
+    show_menu_header "Copy Fail 修补 — 禁用 algif_aead"
+
+    echo "  此操作将创建 /etc/modprobe.d/pve-tools-copyfail.conf"
+    echo "  禁用 algif_aead 内核模块"
+    echo "$UI_DIVIDER"
+    echo -e "${RED}重要提示：${NC}"
+    echo "  • Copy Fail 缓解措施（禁用 algif_aead）${RED}可被 Dirty Frag 绕过${NC}"
+    echo "  • 建议同步应用 Dirty Frag 修补（esp4/esp6/rxrpc）"
+    echo "  • 推荐方案：使用「一键批量修补」或升级内核"
+    echo "$UI_DIVIDER"
+
+    if ! confirm_high_risk_action \
+        "禁用 algif_aead 模块 (Copy Fail 缓解)" \
+        "将创建 modprobe.d 黑名单阻止 algif_aead 加载，并卸载已加载的模块。" \
+        "可能影响 IPsec AEAD 相关功能。此措施可被 Dirty Frag 绕过。" \
+        "建议同时应用 Dirty Frag 修补。" \
+        "CONFIRM"; then
+        log_info "用户取消操作"
+        return 0
+    fi
+
+    security_cve_module_blacklist "pve-tools-copyfail" "algif_aead"
+    security_cve_rmmod_and_drop_caches "algif_aead"
+    log_success "Copy Fail 缓解措施已应用"
+    log_tips "建议立即前往 Dirty Frag 页面应用完整修补"
+    pause_function
+}
+
+# ============================================================
+# Dirty Frag — xfrm-ESP + RxRPC Page-Cache Write LPE
+#   CVE-2026-43284 + CVE-2026-43500
+# ============================================================
+
+security_cve_dirtyfrag_detect() {
+    clear
+    show_menu_header "Dirty Frag (CVE-2026-43284 + CVE-2026-43500) 检测"
+
+    echo -e "${CYAN}漏洞概述：${NC}"
+    echo "  Dirty Frag 是 Dirty Pipe/Copy Fail 同类 Page-Cache Write 漏洞"
+    echo "  由两个漏洞链式组合实现通用 Linux 本地提权 (LPE → root)"
+    echo "  是确定性逻辑漏洞，无需竞争条件，成功率极高"
+    echo ""
+    echo "  CVE-2026-43284: xfrm-ESP Page-Cache Write (2017-01 ~ 2026-05-05)"
+    echo "    修复提交: f4c50a4034e6 | 模块: esp4, esp6"
+    echo "  CVE-2026-43500: RxRPC Page-Cache Write (2023-06 ~ 2026-05-10)"
+    echo "    修复提交: aa54b1d27fe0 | 模块: rxrpc"
+    echo "  参考链接：https://github.com/V4bel/dirtyfrag"
+    echo "$UI_DIVIDER"
+
+    echo -e "${CYAN}模块检测：${NC}"
+    local found=0
+    local -a mods=("esp4" "esp6" "rxrpc")
+    for mod in "${mods[@]}"; do
+        if lsmod 2>/dev/null | grep -q "^$mod "; then
+            echo -e "  $mod: ${RED}已加载${NC}"
+            found=1
+        elif modinfo "$mod" &>/dev/null; then
+            echo -e "  $mod: ${YELLOW}可用但未加载${NC}"
+            found=1
+        else
+            echo -e "  $mod: ${GREEN}不可用${NC}"
+        fi
+    done
+
+    echo "$UI_DIVIDER"
+    local current_kernel
+    current_kernel="$(uname -r)"
+    echo -e "当前内核: ${CYAN}$current_kernel${NC}"
+
+    if [[ "$found" -eq 1 ]]; then
+        echo -e "${RED}[警告] 检测到 Dirty Frag 攻击面！可被非特权用户利用提权至 root。${NC}"
+    else
+        echo -e "${GREEN}未检测到 Dirty Frag 直接攻击面。${NC}"
+    fi
+    pause_function
+    return 0
+}
+
+security_cve_dirtyfrag_mitigate() {
+    block_non_pve9_destructive "Dirty Frag 修补" || return 1
+
+    clear
+    show_menu_header "Dirty Frag 修补 — 禁用 esp4/esp6/rxrpc"
+
+    echo "  此操作将创建 /etc/modprobe.d/pve-tools-dirtyfrag.conf"
+    echo "  并禁用以下内核模块：esp4, esp6, rxrpc"
+    echo "$UI_DIVIDER"
+    echo -e "${YELLOW}影响说明：${NC}"
+    echo "  • 禁用 esp4/esp6：影响 IPsec ESP 隧道功能"
+    echo "  • 禁用 rxrpc：影响 RxRPC 协议功能（通常不用于 PVE）"
+    echo "  • 立即生效（卸载已加载模块 + 清理页面缓存）"
+    echo "  • 重启后黑名单持续生效"
+    echo "$UI_DIVIDER"
+
+    if ! confirm_high_risk_action \
+        "禁用 esp4/esp6/rxrpc 模块 (Dirty Frag 修补)" \
+        "将创建 modprobe.d 黑名单并卸载相关模块。立即清理页面缓存。" \
+        "禁用 esp4/esp6 可能影响 IPsec VPN/隧道功能。PVE 通常不依赖这些模块。" \
+        "如需回滚，可使用「恢复模块黑名单」功能。" \
+        "CONFIRM"; then
+        log_info "用户取消操作"
+        return 0
+    fi
+
+    security_cve_module_blacklist "pve-tools-dirtyfrag" "esp4" "esp6" "rxrpc"
+    security_cve_rmmod_and_drop_caches "esp4" "esp6" "rxrpc"
+    log_success "Dirty Frag 缓解措施已应用"
+    log_tips "建议升级内核以获得永久修复"
+    pause_function
+}
+
+# 共享的 LPE 内核升级引导
+security_cve_lpe_kernel_fix() {
+    clear
+    show_menu_header "Copy Fail / Dirty Frag — 升级内核修补"
+
+    echo "  Copy Fail 和 Dirty Frag 均属于 Page-Cache Write 漏洞类"
+    echo "  以下内核补丁已合入主线："
+    echo "    Copy Fail:   (algif_aead 相关修复)"
+    echo "    Dirty Frag:  f4c50a4034e6 (xfrm-ESP, 2026-05-05)"
+    echo "                  aa54b1d27fe0 (RxRPC,   2026-05-10)"
+    echo "$UI_DIVIDER"
+
+    local current_kernel
+    current_kernel="$(uname -r)"
+    echo -e "  当前内核版本: ${CYAN}$current_kernel${NC}"
+    echo -e "  建议升级到 2026-05-10 之后编译的内核版本"
+    echo "$UI_DIVIDER"
+    echo "  升级后可移除所有模块黑名单，恢复正常功能"
+    echo "$UI_DIVIDER"
+
+    if confirm_action "是否前往内核管理菜单安装新内核？"; then
+        kernel_management_menu
+    fi
+}
+
+# 恢复 Dirty Frag + Copy Fail 模块黑名单
+security_cve_lpe_restore() {
+    block_non_pve9_destructive "恢复 LPE 模块黑名单" || return 1
+
+    clear
+    show_menu_header "恢复 LPE 模块黑名单"
+
+    echo "  此操作将移除以下模块黑名单配置："
+    echo "    • /etc/modprobe.d/pve-tools-dirtyfrag.conf (esp4/esp6/rxrpc)"
+    echo "    • /etc/modprobe.d/pve-tools-copyfail.conf (algif_aead)"
+    echo "$UI_DIVIDER"
+    echo -e "${RED}警告：${NC}"
+    echo "  • 移除黑名单后，如果内核未升级到已修复版本，系统将重新面临 LPE 风险"
+    echo "  • 建议先确认内核已包含 Copy Fail/Dirty Frag 修复"
+    echo "$UI_DIVIDER"
+
+    if ! confirm_high_risk_action \
+        "恢复 LPE 相关模块黑名单" \
+        "将删除 modprobe.d 中的 Copy Fail 和 Dirty Frag 黑名单配置。" \
+        "如果内核未包含修复，系统将重新面临本地提权风险。" \
+        "请确认内核已升级到已修复版本。" \
+        "CONFIRM"; then
+        log_info "用户取消操作"
+        return 0
+    fi
+
+    security_cve_module_restore "pve-tools-dirtyfrag"
+    security_cve_module_restore "pve-tools-copyfail"
+    log_success "LPE 模块黑名单已移除，重启后生效"
+    pause_function
+}
+
+# ============================================================
+# 一键批量修补
+# ============================================================
+
+security_cve_batch_mitigate() {
+    block_non_pve9_destructive "一键批量修补" || return 1
+
+    clear
+    show_menu_header "一键批量漏洞修补"
+
+    echo "  此操作将一次性应用以下所有缓解措施："
+    echo ""
+    echo "  ${CYAN}1. Januscape (CVE-2026-53359) — KVM 逃逸${NC}"
+    echo "     → 禁用嵌套虚拟化 (kvm_intel/kvm_amd.nested=0)"
+    echo ""
+    echo "  ${CYAN}2. Dirty Frag (CVE-2026-43284 + CVE-2026-43500) — LPE${NC}"
+    echo "     → 禁用 esp4/esp6/rxrpc 模块"
+    echo ""
+    echo "  ${CYAN}3. Copy Fail — LPE (额外加固)${NC}"
+    echo "     → 禁用 algif_aead 模块"
+    echo "$UI_DIVIDER"
+    echo -e "${RED}影响汇总：${NC}"
+    echo "  • 关闭嵌套虚拟化：VM 内无法运行嵌套 VM (L2)"
+    echo "  • 关闭 IPsec ESP：影响 VPN/隧道功能"
+    echo "  • 所有措施重启后生效"
+    echo "  • 升级内核后可逐一恢复各项功能"
+    echo "$UI_DIVIDER"
+
+    if ! confirm_high_risk_action \
+        "一键批量应用所有 CVE 缓解措施" \
+        "将同时禁用 KVM 嵌套虚拟化、esp4/esp6/rxrpc/algif_aead 模块。" \
+        "影响嵌套 VM、IPsec VPN 等功能。重启后生效。" \
+        "建议先在测试环境验证，确保业务不受影响。" \
+        "BATCH-FIX"; then
+        log_info "用户取消操作"
+        return 0
+    fi
+
+    # 1. Januscape
+    local vendor
+    if vendor="$(security_cve_detect_cpu_vendor)"; then
+        case "$vendor" in
+            intel) grub_add_param "kvm_intel.nested=0" && log_success "Januscape: kvm_intel.nested=0 已添加" ;;
+            amd)   grub_add_param "kvm_amd.nested=0" && log_success "Januscape: kvm_amd.nested=0 已添加" ;;
+        esac
+    else
+        log_warn "Januscape: 未检测到 KVM，跳过"
+    fi
+
+    # 2. Dirty Frag
+    security_cve_module_blacklist "pve-tools-dirtyfrag" "esp4" "esp6" "rxrpc"
+    security_cve_rmmod_and_drop_caches "esp4" "esp6" "rxrpc"
+
+    # 3. Copy Fail
+    security_cve_module_blacklist "pve-tools-copyfail" "algif_aead"
+    security_cve_rmmod_and_drop_caches "algif_aead"
+
+    # 4. Update GRUB
+    if command -v update-grub &>/dev/null; then
+        update-grub
+    elif command -v grub-mkconfig &>/dev/null; then
+        grub-mkconfig -o /boot/grub/grub.cfg
+    fi
+
+    echo
+    log_success "批量修补完成！所有缓解措施已应用"
+    log_tips "请重启系统使 GRUB 参数生效"
+    echo
+    if confirm_action "是否现在重启系统？"; then
+        reboot
+    fi
+}
+
+# ============================================================
 # CVE 漏洞修补主菜单
+# ============================================================
+
 security_cve_menu() {
     while true; do
         clear
         show_menu_header "CVE 漏洞修补中心"
-        echo -e "${CYAN}当前关注漏洞：${NC}"
-        echo "  Januscape (CVE-2026-53359) — KVM Guest-to-Host Escape"
-        echo "  影响范围: 2010~2026 | 危害: 严重 | 修复: 81ccda30b4e8"
+
+        echo -e "${CYAN}已收录漏洞：${NC}"
+        echo "  Januscape  (CVE-2026-53359)          KVM Guest-to-Host Escape"
+        echo "  Dirty Frag (CVE-2026-43284/43500)    Page-Cache Write LPE"
+        echo "  Copy Fail                             Page-Cache Write LPE"
         echo "$UI_DIVIDER"
-        show_menu_option "1" "漏洞检测 ${CYAN}(检测系统是否存在 Januscape 风险)${NC}"
-        show_menu_option "2" "临时修补 ${YELLOW}(禁用嵌套虚拟化，重启生效)${NC}"
-        show_menu_option "3" "升级内核修补 ${GREEN}(安装已修复的内核，推荐)${NC}"
-        show_menu_option "4" "恢复嵌套虚拟化 ${RED}(移除禁用参数，请先确认内核已修复)${NC}"
+        show_menu_option "1" "Januscape  ${CYAN}(KVM 逃逸 — 检测/修补/恢复)${NC}"
+        show_menu_option "2" "Dirty Frag ${RED}(本地提权 — 检测/修补/恢复)${NC}"
+        show_menu_option "3" "Copy Fail  ${YELLOW}(本地提权 — 检测/修补/恢复)${NC}"
+        echo "$UI_DIVIDER"
+        show_menu_option "8" "一键批量修补 ${RED}(同时应用全部缓解措施)${NC}"
+        show_menu_option "9" "升级内核 ${GREEN}(永久修复所有 LPE 漏洞)${NC}"
         echo "$UI_DIVIDER"
         show_menu_option "0" "返回安全中心"
         show_menu_footer
 
+        local choice
+        read -p "请选择操作 [0-9]: " choice
+        case "$choice" in
+            1) security_cve_januscape_menu ;;
+            2) security_cve_dirtyfrag_menu ;;
+            3) security_cve_copyfail_menu ;;
+            8) security_cve_batch_mitigate ;;
+            9) security_cve_lpe_kernel_fix ;;
+            0) return ;;
+            *) log_error "无效选择" ;;
+        esac
+        pause_function
+    done
+}
+
+# Januscape 子菜单
+security_cve_januscape_menu() {
+    while true; do
+        clear
+        show_menu_header "Januscape (CVE-2026-53359) — KVM Guest-to-Host Escape"
+        echo "  影响: 2010-08 ~ 2026-06-19 | 修复: 81ccda30b4e8"
+        echo "$UI_DIVIDER"
+        show_menu_option "1" "漏洞检测 ${CYAN}(嵌套虚拟化 + 内核版本)${NC}"
+        show_menu_option "2" "临时修补 ${YELLOW}(禁用嵌套虚拟化，重启生效)${NC}"
+        show_menu_option "3" "升级内核修补 ${GREEN}(安装已修复内核，推荐)${NC}"
+        show_menu_option "4" "恢复嵌套虚拟化 ${RED}(确认内核已修复后使用)${NC}"
+        echo "$UI_DIVIDER"
+        show_menu_option "0" "返回"
+        show_menu_footer
+
         local choice
         read -p "请选择操作 [0-4]: " choice
         case "$choice" in
@@ -296,3 +663,63 @@ security_cve_menu() {
         pause_function
     done
 }
+
+# Dirty Frag 子菜单
+security_cve_dirtyfrag_menu() {
+    while true; do
+        clear
+        show_menu_header "Dirty Frag (CVE-2026-43284 + CVE-2026-43500) — LPE"
+        echo "  影响: 2017-01 ~ 2026-05 | 修复: f4c50a4034e6 / aa54b1d27fe0"
+        echo "$UI_DIVIDER"
+        show_menu_option "1" "漏洞检测 ${CYAN}(esp4/esp6/rxrpc 模块)${NC}"
+        show_menu_option "2" "临时修补 ${YELLOW}(禁用 esp4/esp6/rxrpc，立即生效)${NC}"
+        show_menu_option "3" "升级内核修补 ${GREEN}(安装已修复内核，推荐)${NC}"
+        show_menu_option "4" "恢复模块黑名单 ${RED}(确认内核已修复后使用)${NC}"
+        echo "$UI_DIVIDER"
+        show_menu_option "0" "返回"
+        show_menu_footer
+
+        local choice
+        read -p "请选择操作 [0-4]: " choice
+        case "$choice" in
+            1) security_cve_dirtyfrag_detect ;;
+            2) security_cve_dirtyfrag_mitigate ;;
+            3) security_cve_lpe_kernel_fix ;;
+            4) security_cve_lpe_restore ;;
+            0) return ;;
+            *) log_error "无效选择" ;;
+        esac
+        pause_function
+    done
+}
+
+# Copy Fail 子菜单
+security_cve_copyfail_menu() {
+    while true; do
+        clear
+        show_menu_header "Copy Fail — Page-Cache Write LPE"
+        echo "  Dirty Pipe/Dirty Frag 同类漏洞 | 参考: https://copy.fail"
+        echo "$UI_DIVIDER"
+        show_menu_option "1" "漏洞检测 ${CYAN}(algif_aead 模块)${NC}"
+        show_menu_option "2" "临时修补 ${YELLOW}(禁用 algif_aead，立即生效)${NC}"
+        show_menu_option "3" "升级内核修补 ${GREEN}(安装已修复内核，推荐)${NC}"
+        show_menu_option "4" "恢复模块黑名单 ${RED}(确认内核已修复后使用)${NC}"
+        echo "$UI_DIVIDER"
+        echo -e "${RED}注意：Copy Fail 缓解可被 Dirty Frag 绕过，建议同时修补！${NC}"
+        echo "$UI_DIVIDER"
+        show_menu_option "0" "返回"
+        show_menu_footer
+
+        local choice
+        read -p "请选择操作 [0-4]: " choice
+        case "$choice" in
+            1) security_cve_copyfail_detect ;;
+            2) security_cve_copyfail_mitigate ;;
+            3) security_cve_lpe_kernel_fix ;;
+            4) security_cve_lpe_restore ;;
+            0) return ;;
+            *) log_error "无效选择" ;;
+        esac
+        pause_function
+    done
+}