fix: narrow Ubuntu kernel module deny mitigation

[djsly]

Summary

Narrow the Copy Fail + DirtyFrag + Fragnesia kernel module deny mitigation so future fixed Ubuntu VHDs no longer bake or apply deny rules for algif_aead, esp4, esp6, and rxrpc, while preserving protection for old or unknown Ubuntu kernels and the non-Ubuntu streams that still need it.

Changes

• Keep baking the baseline modprobe-CIS.conf CIS hardening into future Ubuntu 22.04/24.04 VHDs, but filter and scrub the vulnerable-module deny rules for algif_aead, esp4, esp6, and rxrpc.
• Add kernel-aware CSE gating for Ubuntu so vulnerable/unknown kernels still get runtime deny rules, but fixed kernels are unblocked.
• Keep the existing mitigation for AzureLinux OSGuard and Mariner/AzureLinux 2.0.
• Update ShellSpec, E2E validator, and VHD content tests for the new Ubuntu behavior.
• Harden semverCompare extraction for kernel-version comparisons.

Fixed Ubuntu kernel cutoffs

• Ubuntu 22.04 Azure kernel: 5.15.0-1116-azure
• Ubuntu 22.04 generic fallback: 5.15.0-181-generic
• Ubuntu 24.04 Azure kernel: 6.8.0-1058-azure
• Ubuntu 24.04 generic fallback: 6.8.0-124-generic

The Ubuntu 24.04 cutoff is intentionally conservative; old, unknown, or undetectable Ubuntu kernels remain protected by default.

Testing

• shellspec --shell bash spec/parts/linux/cloud-init/artifacts/cse_main_disable_modules_spec.sh
• bash -n vhdbuilder/packer/test/linux-vhd-content-test.sh
• bash -n vhdbuilder/packer/packer_source.sh
• cd e2e && go test ./... -run '^$'
• GOPROXY=https://proxy.golang.org,direct GENERATE_TEST_DATA=true go test ./pkg/agent...
• Direct semverCompare smoke test for equal/newer/older kernel versions

Note: make generate was attempted first, but the configured Go proxy returned 401 Unauthorized while installing github.com/onsi/ginkgo/v2/ginkgo@v2.1.1; the documented narrower generation path above completed successfully with the public Go proxy.

Related

• AB#38890309
• Kernel LPE Vulnerabilities (Copy Fail + DirtyFrag + Fragnesia) — AKS Advisory & Mitigation Guide AKS#5753

🤖 Generated by GitHub Copilot

[Copilot]

Pull request overview

This PR narrows the “Copy Fail + DirtyFrag + Fragnesia” kernel module deny mitigation so that newly built Ubuntu 22.04/24.04 VHDs no longer bake the modprobe blacklist, while CSE-time enforcement remains for older/unknown Ubuntu kernels and for non-Ubuntu OS streams that still require the mitigation.

Changes:

• Skip baking the vulnerable-module blacklist into Ubuntu 22.04/24.04 VHDs (while still skipping AzureLinux 3.0 non-OSGuard as before).
• Add Ubuntu kernel-version-aware gating in cse_main.sh so runtime deny rules apply only on vulnerable/unknown Ubuntu kernels.
• Update VHD content tests, ShellSpec coverage, and E2E validation to reflect the new Ubuntu behavior; harden semverCompare()’s highest-version extraction.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
vhdbuilder/packer/test/linux-vhd-content-test.sh	Updates VHD content assertions so Ubuntu 22.04/24.04 now expect absence of the blacklist entries (similar to AzureLinux 3.0).
vhdbuilder/packer/packer_source.sh	Skips baking modprobe-CIS.conf on Ubuntu 22.04/24.04 to avoid blocking modules on fixed kernels; keeps bake-in for other OS streams.
spec/parts/linux/cloud-init/artifacts/cse_main_disable_modules_spec.sh	Adds ShellSpec coverage for the Ubuntu kernel gate and updates the OS gate tests accordingly.
parts/linux/cloud-init/artifacts/cse_main.sh	Introduces ubuntuKernelNeedsVulnerableModuleMitigation() and gates runtime module disabling on vulnerable Ubuntu kernels only.
parts/linux/cloud-init/artifacts/cse_helpers.sh	Fixes semverCompare() to reliably select the highest version from sorted output.
e2e/validators.go	Updates E2E validation to accept “blacklist absent” on fixed Ubuntu kernels while retaining full enforcement checks on vulnerable/unknown Ubuntu kernels and other OSes.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (3)

parts/linux/cloud-init/artifacts/cse_helpers.sh:753

• Same as above: use suffix matches (*-azure / *-generic) so unknown Ubuntu 24.04 kernel flavors don’t get misclassified as “known” and accidentally skip the mitigation.

            case "$kernel_release" in
                *-azure*) fixed_kernel="6.8.0-1058-azure" ;;
                *-generic*) fixed_kernel="6.8.0-124-generic" ;;

vhdbuilder/packer/cleanup-vhd.sh:46

• Same as above for Ubuntu 24.04 cleanup: match *-azure / *-generic suffixes to avoid treating unknown kernel flavors as fixed.

      case "$kernel_release" in
        *-azure*) fixed_kernel="6.8.0-1058-azure" ;;
        *-generic*) fixed_kernel="6.8.0-124-generic" ;;

e2e/validators.go:3176

• Same as above for Ubuntu 24.04 E2E validation: switch to *-azure / *-generic suffix matches to keep unknown kernel flavors treated as “unknown” (and therefore requiring the mitigation).

			`    case "$kernel_release" in`,
			`      *-azure*) fixed_kernel="6.8.0-1058-azure" ;;`,
			`      *-generic*) fixed_kernel="6.8.0-124-generic" ;;`,
			`    esac`,

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[djsly]

E2E follow-up:

• Test_Ubuntu2404_MANA failed with a kubelet exec proxy 502 Bad Gateway while dialing the node kubelet (:10250). That points to an infra/test connectivity flake and does not match this PR's module-deny behavior.
• The actionable failure was the VHD caching Ubuntu path: a fixed Ubuntu kernel (5.15.0-1117-azure) still had stale algif_aead / esp4 / esp6 / rxrpc deny rules under /etc/modprobe.d. The validator was correct to fail because bake-time filtering alone does not cover older/PIS-cached VHDs that already contain those rules.

Pushed 70893aece6 to remove stale Copy Fail / DirtyFrag / Fragnesia deny rules at CSE time when Ubuntu is running a fixed kernel, while preserving the mitigation for vulnerable/unknown Ubuntu kernels and the non-Ubuntu streams that still need it.

Validation run:

• shellspec spec/parts/linux/cloud-init/artifacts/cse_main_disable_modules_spec.sh
• bash -n parts/linux/cloud-init/artifacts/cse_main.sh spec/parts/linux/cloud-init/artifacts/cse_main_disable_modules_spec.sh
• shellcheck -S error parts/linux/cloud-init/artifacts/cse_main.sh spec/parts/linux/cloud-init/artifacts/cse_main_disable_modules_spec.sh
• git diff --check
• GENERATE_TEST_DATA=true go test ./pkg/agent...

Note: make generate is still blocked locally by the internal Go proxy returning 401 while installing pinned ginkgo, so I used the targeted generation path.

🤖 Generated by GitHub Copilot

[github-actions]

Windows Unit Test Results

  3 files   11 suites   52s ⏱️
381 tests 381 ✅ 0 💤 0 ❌
384 runs  384 ✅ 0 💤 0 ❌

Results for commit d5aad21.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

parts/linux/cloud-init/artifacts/cse_main.sh:388

• The fixed-Ubuntu-kernel unblock path (removeVulnerableKernelModuleDenyRules) is executed only in basePrep. On PIS/VHD-cached nodes where /opt/azure/containers/base_prep.complete is baked into the image, basePrep is skipped and nodePrep runs; in that case any stale baked deny rules for algif_aead/esp4/esp6/rxrpc would never be removed, so fixed kernels could remain blocked contrary to the intended behavior. Consider running the Ubuntu mitigation/cleanup gate in nodePrep as well (or refactor into a helper invoked from both phases) so fixed-kernel cleanup happens even when basePrep is skipped.

    if isUbuntu "$OS"; then
        if ubuntuKernelNeedsVulnerableModuleMitigation; then
            disableVulnerableKernelModule "algif_aead" "CVE-2026-31431 (Copy Fail)"
            disableVulnerableKernelModule "esp4" "DirtyFrag (xfrm-ESP page-cache write)"
            disableVulnerableKernelModule "esp6" "DirtyFrag (xfrm-ESP6 page-cache write)"
            disableVulnerableKernelModule "rxrpc" "DirtyFrag (RxRPC page-cache write, bypasses AppArmor userns)"
        else
            removeVulnerableKernelModuleDenyRules || exit $ERR_MODPROBE_FAIL
        fi

[djsly]

Addressed the latest Copilot review note about PIS: the Ubuntu mitigation decision is now centralized in reconcileVulnerableKernelModuleMitigation() and invoked from both basePrep and nodePrep, so fixed-kernel PIS nodes can remove stale baked deny rules even when basePrep is skipped.

Validation rerun on the new commit:

• shellspec spec/parts/linux/cloud-init/artifacts/cse_main_disable_modules_spec.sh
• bash -n parts/linux/cloud-init/artifacts/cse_main.sh spec/parts/linux/cloud-init/artifacts/cse_main_disable_modules_spec.sh
• shellcheck -S error parts/linux/cloud-init/artifacts/cse_main.sh spec/parts/linux/cloud-init/artifacts/cse_main_disable_modules_spec.sh
• git diff --check
• GENERATE_TEST_DATA=true go test ./pkg/agent...

🤖 Generated by GitHub Copilot

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.