Proof-of-concept code published for Dirty Frag in the Linux kernel

Security researchers have released public proof-of-concept code for Dirty Frag, a Linux privilege escalation technique that chains two kernel vulnerabilities to obtain root. It combines flaws in xfrm-ESP and RxRPC functionality, allowing attackers to overwrite page cache contents and replace binaries with attacker-controlled payloads.

The researchers describe the technique as deterministic, with a high success rate and no reliance on race conditions. The published example code demonstrates overwriting system binaries such as /usr/bin/su with a minimal root shell payload. Patches for both vulnerabilities are already in the Linux kernel mainline.

What this means for your business

Once exploit code is public and the technique works reliably every time, the argument that a flaw is hard to use in practice disappears. The bar drops to anyone who already holds an ordinary user account on the machine. For organisations running Linux in production, kernel patching can no longer wait for the next quarterly window.

Berigo recommends

• Take the kernel update as soon as your distribution ships it, and track which machines still lack it.
• Prioritise servers where multiple users have shell access, and servers exposing applications to the internet.
• Establish a standing kernel patching process with a defined deadline rather than handling each case individually.
• Monitor changes to key system binaries such as /usr/bin/su.

Source

• github.com