Dirty Frag Linux Kernel Flaw Enables Root Escalation

Security researchers have disclosed a critical vulnerability in the Linux kernel, dubbed Dirty Frag, that enables an unprivileged local user to gain root privileges on most major Linux distributions, including Ubuntu, Red Hat Enterprise Linux, Fedora, AlmaLinux, CentOS Stream, and openSUSE.

The flaw, discovered by researcher Hyunwoo Kim, chains two separate PageCache write vulnerabilities: one in the IPsec xfrmESP subsystem, introduced in a January 2017 kernel commit, and another in the RxRPC subsystem, added in June 2023. According to Kim, the exploits target zerocopy send paths where splice attaches a read-only page cache page, such as those for /etc/passwd or /usr/bin/su, to a socket buffer fragment. Receiver-side kernel code then performs inplace cryptographic operations, modifying the page in RAM. Subsequent reads reflect the changes, allowing privilege escalation.

"This is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high," Kim stated in his advisory. Neither flaw works universally alone; the xfrmESP variant requires user namespace creation,...