The Dirty Frag Exploit
A researcher publicly disclosed a universal Linux local privilege escalation (LPE) exploit called Dirty Frag, which allows an attacker to obtain root privileges on all major distributions [1]. The exploit chains two separate vulnerabilities [2]. No patches or CVEs exist for these vulnerabilities because the embargo was broken [3].
Disclosure and Embargo
The vulnerability was publicly released by Hyunwoo Kim after consultation with linux-distros@openwall.org maintainers [4]. The broken embargo has left systems vulnerable with no official fix in sight.
How the Exploit Works
The exploit code overwrites the first 192 bytes of /usr/bin/su with a minimal x86_64 root-shell ELF [5]. Alternatively, the rxrpc/rxkad LPE path patches /etc/passwd to set the root user's password field empty [6]. The exploit uses a PTY bridge to spawn an interactive root shell via su [7]. It also includes a user-space brute-force to find session keys for the rxrpc path [8].
Mitigation
The exploit provides a mitigation command to remove vulnerable kernel modules: esp4, esp6, and rxrpc [9]. Administrators are advised to apply this mitigation immediately until patches are released.
Impact and Comparison
The vulnerability has similar impact to the previous Copy Fail vulnerability [10], affecting a wide range of systems globally.
What to Watch Next
Monitor the linux-distros mailing list and kernel security announcements for patches. Until then, apply the mitigation and restrict local access to trusted users.