Dirtyfrag: Universal Linux LPE

A new universal Local Privilege Escalation (LPE) vulnerability, dubbed "Dirty Frag," has been publicly disclosed, allowing attackers to gain root access on virtually all major Linux distributions. The disclosure came abruptly after an embargo was broken by a third party, forcing the immediate release of technical details and exploit code before official patches were widely available.

• Dirty Frag chains two distinct kernel vulnerabilities: an xfrm-ESP page-cache write and an rxrpc/rxkad flaw.
• The xfrm-ESP component enables overwriting arbitrary portions of a file's page cache, demonstrated by injecting a root shell ELF into /usr/bin/su and bypassing known mitigations for the "Copy Fail" vulnerability.
• The rxrpc/rxkad component allows modifying sensitive files like /etc/passwd to enable password-less root logins.
• The vulnerability is widespread, affecting most major Linux distributions.
• The responsible disclosure process was disrupted when an unrelated third party publicly released details and an exploit, leading the original discoverer to release the full Dirty Frag documentation immediately.
• Temporary mitigation involves blacklisting and unloading the esp4, esp6, and rxrpc kernel modules.

This rapid, unscheduled disclosure underscores the challenges of coordinated security efforts in open-source ecosystems and highlights the persistent threat of privilege escalation vulnerabilities arising from complex kernel functionalities.