Forgot your password?
Close
typodupeerror
Security Linux

New Linux 'Dirty Frag' Zero-Day Gives Root On All Major Distros (bleepingcomputer.com) 44

Posted by BeauHD from the here-we-go-again dept.
mrspoonsi shares a report: Dirty Frag is a vulnerability class, first discovered and reported by Hyunwoo Kim (@v4bel), that can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability. Dirty Frag extends the bug class to which Dirty Pipe and Copy Fail belong. Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high. Because the embargo has been broken, no patch or CVE currently exists. "As with the previous Copy Fail vulnerability, Dirty Frag likewise allows immediate root privilege escalation on all major distributions, and it chains two separate vulnerabilities," Kim said. Detailed technical information can be found here.

BleepingComputer notes that the two vulnerabilities chained by Dirty Frag are "now tracked under the following CVE IDs: the xfrm-ESP one was assigned CVE-2026-43284, and the RxRPC isye is now CVE-2026-43500."
This discussion has been archived. No new comments can be posted.

New Linux 'Dirty Frag' Zero-Day Gives Root On All Major Distros More

New Linux 'Dirty Frag' Zero-Day Gives Root On All Major Distros

Comments Filter:

  • On your mark, get set... GO! (Score:5, Funny)

    by 93 Escort Wagon ( 326346 ) on Friday May 08, 2026 @05:25PM (#66134822)

    Quick - copy and paste all your comments from the "Copy Fail" discussion over here!

    • Re:On your mark, get set... GO! (Score:5, Informative)

      by markdavis ( 642305 ) on Friday May 08, 2026 @05:34PM (#66134826)

      >"Quick - copy and paste all your comments from the "Copy Fail" discussion over here!"

      Pretty much :) It is essentially the same issue, found in three other kernel modules. Alma Linux and others already have pages up about it. These are serious issues for multiuser/multitenant servers needing to mitigate immediately. Not so much for single-user or home systems.

      Copy Fail used the algif_aead module and for enterprise Linuxes, that is built-into the kernel. So either update the kernel, or mitigate with:

      # grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"

      and reboot. Dirty Frag uses three additional modules: esp4, esp6, and rxrpc. Enterprise Linuxes don't build those in, so all distros should be able to use something like:

      # rmmod esp4 esp6 rxrpc
      # sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf"

      for immediate mitigation, without rebooting. Of course, disabling those modules has a price, it will disable IPsec ESP, IPsec VPNs (like Swan), and AFS clients. So if you use/need those, you can't mitigate without losing that functionality.

  • Embargo intrigue (Score:5, Interesting)

    by Himmy32 ( 650060 ) on Friday May 08, 2026 @05:37PM (#66134834)

    There's a little more intrigue here on the breaking of the embargo. Basically the bugs were responsibly reported and the finders helped with writing the patch under embargo. Then when the patch commit dropped, someone instantly figured out that it was the same class of bug as Copy Fail. And then someone then wrote new exploit code [afflicted.sh] for the bug before the patch worked it's way through. No one improperly leaked something, but watching new patches for previous exploits was quicker than the patch could work it's way through the system.

    Which leaves us where we are with Hyunwoo Kim releasing the original exploit code early and a patch that seems to have made it into the kernel [kernel.org], but without downstream distro's having released their patches.

    Here's the link to the mitigation [github.com] for anyone wanting to deal with it before their distro drops their patch. Noting that the mitigation will break IPsec VPNs and AFS distributed network file systems.

  • The post itself has an error. The last link's URL points to the same page as the predecessor. There is no record for 43500

  • Deja Vu (Score:5, Insightful)

    by gQuigs ( 913879 ) on Friday May 08, 2026 @05:59PM (#66134878) Homepage

    I'm expecting this next year to be rough for patching systems with AI getting good at this. I'd guess at least one new zero of a similar urgency every 2 weeks for Linux.

    So 16 until the end of the year.

    I think we will be more secure at the end of it.. but it could be rough.

    • It will certainly force users/providers/administrator to review their patching processes, and velocity.

    • Re: (Score:2)

      by Slayer ( 6656 )

      If this puts companies like Celebrite out of business, then I'll happily accept, that I have to update my servers 16 times a year until 2028. At least the linux branches of these companies can go, I don't care much about the others.

  • Was already patched in my distro before the embargo was broken.

  • What access is required to use these vulns?

    • Re: (Score:2)

      by Himmy32 ( 650060 )
      The CVSS 3.x / 4.x score that have a Privileges Required Score which in this case is rated "Low" [nist.gov]. Which makes sense since these are a Privilege Escalation attack, you can read up on how different distros are handle things in the researcher's Chaining section of the write-up [github.com]

    • Local access, unless you haven't patched apache this week, then it's remote access.

      • Re: (Score:2)

        by SpzToid ( 869795 )

        Local access, unless you haven't patched apache this week, then it's remote access.

        What if you're using OpenLiteSpeed instead of Apache? Asking for a friend.

    • Arbitrary code execution - a type of access that is ubiquitous in the bugs of countless programs (which is why we don't allow them to run with privileges in the first place)

  • Android (Score:4, Interesting)

    by OrangAsm ( 678078 ) on Friday May 08, 2026 @06:43PM (#66134938)
    What happens if you run the exploit on Android?

  • Are there any tools to watch my lsmod, walk /lib/modules, and configure modprobe.d to deny loading anything I'm not using?

    All of these exploits are in distro modules I'd never use.

    • Re: (Score:3)

      by Himmy32 ( 650060 )
      SELinux and don't let things have module_load that don't need it? And if you didn't want to enforce, it'd get you the audit log.

    • Re: (Score:2)

      by gweihir ( 88907 )

      You can delete the modules or move them some place else. What the kernel does not find, it does not load.

  • OMG (Score:3)

    by Tommy_S ( 580744 ) <buddy@tomcat.umsl.edu> on Friday May 08, 2026 @07:10PM (#66134988)
    I bet it was less than 3 minutes from the time I saw this slashdot article to the time I had clicked on the details link downloaded compiled and ran the exploit to root this Fedora system I'm on. That is freakin' scary. I'm glad I'm not a Linux Admin anymore.
  • We're in the middle of emergency patching 6000 Linux hosts to address copy fail, now we have another set of CVEs to urgently patch? Oh boy
  • Are people still managing multiple users on their Linux machines? Why? Are these users other processes that we are pretending are separate and safe (so called lower privileges on the system) as if these exploits haven't been around since UNIX existed.
    • You realise that servers exist? Which people have to be able to log into?

      Anyway in my case in theory my clients could try to get out of the git-shell I guess.
      Server patched and rebooted

    • You are missing the fact that a remote exploit to run unprivileged commands is a far lower bar to achieve than priveleged. And that there are many, many, MANY systems that intentionally give access to unpriveleged commands through web interfaces to a wide audience.

  • The class of bugs for PipeFail can be prevented in principle with X^W [wikipedia.org], which is implemented in PaX, Exec Shield, and some SELinux configs.

    Is any distribution that comes with these in the default installation protected against these exploits? If not, what is missing in terms of mitigation protections against this class of bugs?

  • blacklisting the rpc module and disabling user namespaces seem to block the exploit on older kernels without having to blacklist ipsec modules according to my limited testing, YMMV. it probably breaks eg. rootless docker user mapping so there is a tradeoff

Slashdot Top Deals

How many Bavarian Illuminati does it take to screw in a lightbulb? Three: one to screw it in, and one to confuse the issue.

Close