[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-11316":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":8,"htmlUrl":8,"language":9,"languages":8,"totalLinesOfCode":8,"stars":10,"forks":11,"watchers":12,"openIssues":13,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":15,"stars7d":16,"stars30d":17,"stars90d":14,"forks30d":14,"starsTrendScore":16,"compositeScore":18,"rankGlobal":8,"rankLanguage":8,"license":8,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":19,"hasPages":19,"topics":21,"createdAt":8,"pushedAt":8,"updatedAt":22,"readmeContent":23,"aiSummary":24,"trendingCount":14,"starSnapshotCount":14,"syncStatus":25,"lastSyncTime":26,"discoverSource":27},11316,"dirtyfrag","V4bel\u002Fdirtyfrag","V4bel",null,"C",4832,775,49,48,0,4,18,624,81.67,false,"master",[],"2026-06-12 04:00:54","# Dirty Frag: Universal Linux LPE\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Ftux.png\" width=\"400\" alt=\"tux\">\n\u003C\u002Fp>\n\n# Abstract\n\n![tux](assets\u002Fdemo.gif)\n\nThis document describes the Dirty Frag vulnerability class, first discovered and reported by [Hyunwoo Kim (@v4bel)](https:\u002F\u002Fx.com\u002Fv4bel), which can obtain root privileges on major Linux distributions by chaining the `xfrm-ESP Page-Cache Write (CVE-2026-43284)` vulnerability and the `RxRPC Page-Cache Write (CVE-2026-43500)` vulnerability.\n\nDirty Frag is a case that extends the bug class to which [Dirty Pipe](https:\u002F\u002Fdirtypipe.cm4all.com\u002F) and [Copy Fail](https:\u002F\u002Fcopy.fail\u002F) belong. Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high.\n\nFor detailed technical information and the timeline, [see here](assets\u002Fwrite-up.md).\n\n- `xfrm-ESP Page-Cache Write (CVE-2026-43284)` was patched in mainline [f4c50a4034e6](https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Ftorvalds\u002Flinux.git\u002Fcommit\u002F?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4).\n- `RxRPC Page-Cache Write (CVE-2026-43500)` was patched in mainline [aa54b1d27fe0](https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Ftorvalds\u002Flinux.git\u002Fcommit\u002F?id=aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71).\n\n> [!NOTE]\n> At the time this document was first made public (2026-05-07), the embargo had been broken due to external factors, so no patch or CVE existed yet. After consultation with the maintainers on linux-distros@vs.openwall.org at that time, the Dirty Frag document was published at their request. For the disclosure timeline, refer to the technical details.\n\n# Exploiting\n\n## One-line special\n\n```\ngit clone https:\u002F\u002Fgithub.com\u002FV4bel\u002Fdirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && .\u002Fexp\n```\n\nThis PoC is provided as accurate information following consultation with linux-distros. Do not use it on systems that you are not authorized to test.\n\n## Cleanup\n\n⚠️  **Important:** After running this exploit, the page cache is contaminated. To clear the polluted page cache and ensure system stability, either run:\n\n```bash\necho 3 > \u002Fproc\u002Fsys\u002Fvm\u002Fdrop_caches\n```\n\nor reboot the system.\n\n# Affected Versions\n\n- **CVE-2026-43284**: xfrm-ESP Page-Cache Write vulnerability is in scope from [cac2661c53f3 (2017-01-17)](https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Ftorvalds\u002Flinux.git\u002Fcommit\u002F?id=cac2661c53f3) up to [f4c50a4034e6 (2026-05-05)](https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Ftorvalds\u002Flinux.git\u002Fcommit\u002F?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4).\n- **CVE-2026-43500**: RxRPC Page-Cache Write vulnerability is in scope from [2dc334f1a63a (2023-06-08)](https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Ftorvalds\u002Flinux.git\u002Fcommit\u002F?id=2dc334f1a63a) up to [aa54b1d27fe0 (2026-05-10)](https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Ftorvalds\u002Flinux.git\u002Fcommit\u002F?id=aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71).\n\nIn other words, the effective lifetime of the vulnerabilities is about 9 years.\n\nThis Dirty Frag has been tested on the following distribution versions.\n\n- Ubuntu 24.04.4: 6.17.0-23-generic\n- RHEL 10.1: 6.12.0-124.49.1.el10_1.x86_64\n- openSUSE Tumbleweed: 7.0.2-1-default\n- CentOS Stream 10: 6.12.0-224.el10.x86_64\n- AlmaLinux 10: 6.12.0-124.52.3.el10_1.x86_64\n- Fedora 44: 6.19.14-300.fc44.x86_64\n- ...\n\n# Mitigation\n\n1. Use the following command to remove the modules in which the vulnerabilities occur and clear the page cache.\n```bash\nsh -c \"printf 'install esp4 \u002Fbin\u002Ffalse\\ninstall esp6 \u002Fbin\u002Ffalse\\ninstall rxrpc \u002Fbin\u002Ffalse\\n' > \u002Fetc\u002Fmodprobe.d\u002Fdirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>\u002Fdev\u002Fnull; echo 3 > \u002Fproc\u002Fsys\u002Fvm\u002Fdrop_caches; true\"\n```\n\n2. Once each distribution backports a patch, update accordingly.\n\n# FAQ\n\n## Why did you chain two vulnerabilities?\n\nxfrm-ESP Page-Cache Write provides a powerful arbitrary 4-byte STORE primitive like Copy Fail, and is included on most distributions, but it requires the privilege to create a namespace. \n\nUbuntu sometimes blocks unprivileged user namespace creation through AppArmor policy. In such an environment, xfrm-ESP Page-Cache Write cannot be triggered. RxRPC Page-Cache Write does not require the privilege to create a namespace, but the `rxrpc.ko` module itself is not included in most distributions. However, on Ubuntu, the `rxrpc.ko` module is loaded by default. \n\nChaining the two variants makes the blind spots cover each other, allowing root privileges to be obtained on every major distribution. For details, refer to the technical details document.\n\n## Another \"branded\" \"Dirty\" series?\n\nYeah, yeah, I know. However, this vulnerability is a descendant of \"Dirty Pipe\", and it is a bug class that \"dirties\" the `frag` member of `struct sk_buff`, so this name is the most appropriate.\n\n## What is its relationship with the \"Copy Fail\" vulnerability?\n\nCopy Fail was the motivation for starting this research. In particular, xfrm-ESP Page-Cache Write in the Dirty Frag vulnerability chain shares the same sink as Copy Fail. However, it is triggered regardless of whether the algif_aead module is available. In other words, even on systems where the publicly known Copy Fail mitigation (algif_aead blacklist) is applied, your Linux is still vulnerable to Dirty Frag.\n\n## So, how do I fix my Linux?\n\nRefer to the Mitigation section above.\n","Dirty Frag 是一个针对Linux系统的本地权限提升（LPE）漏洞利用项目，通过结合`xfrm-ESP Page-Cache Write (CVE-2026-43284)`和`RxRPC Page-Cache Write (CVE-2026-43500)`两个漏洞，能够在主要的Linux发行版上获取root权限。该项目的核心在于其确定性的逻辑错误特性，不依赖于时间窗口，无需竞态条件，且失败时不会导致内核崩溃，成功率极高。适合安全研究人员、渗透测试人员在授权环境下对目标系统进行安全性评估或漏洞验证使用。注意，在执行完毕后需清理污染的页缓存以保证系统稳定。",2,"2026-06-11 03:31:39","CREATED_QUERY"]