Dirty Frag: Universal Linux LPE - allows any unprivileged local user to gain root access on a vulnerable Linux system - no patch available

What would you use the old phones for out of curiosity?

https://wiki.archlinux.org/title/Modprobed-db can create a profile of the kernel modules that get loaded by your system over time. You can feed that directly into make localmodconfig to build a kernel that only includes those modules, or use the data to build a modprobe whitelist.

Clearly you know of lot about this. Here are some comments for the next human.

Deny all modules seems more possible than a whitelist approach. To deny all, the command is likely “sysctl kernel.modules_disabled=1”.

Whitelisting is harder. One could store a list of all loaded modules on a working system. Store a list of all kernel modules currently installed on the system. Compare the lists and remove from the “all” list the “running” list (grep will do this) and write it to the blacklist file.

The problem with the Whitelisting approach is that it needs to run after every kernel module install (which is doable).

If the above is the case, then someone must have automated this already, but I cannot find it quickly. (I checked Debian’s package repository.)

This was leaked early. There is a mitigation (see link for confirmation):

sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"

Yea it works on arch, I just tested on my own PC:

OS: Arch Linux x86_64
Kernel: Linux 7.0.3-arch1-2

❯ ./exp
[root@arch dirtyfrag]# ls
README.md  assets  exp  exp.c
[root@arch dirtyfrag]# whoami
root

I updated it last week.

Edit: I just ran yay -Suy to update everything and still works.

I also just verified it worked on my Arch install. But running the mitigation command and rebooting effectively blocked it, and I’m on the Arch LTS kernel. I think the disabled modules are related to IPSec, which most desktop users don’t really need.

Its a kernel exploit, so probably. But I just checked my arch installs,and I don’t have any of the kernel modules loaded. Loading requires root anyway, so I think this may be fairly limited in reality?

Nah, people just started using LLM assisted vuln discovery workflows and having early successes with them.

There will be diminishing returns.

I’m pretty sure it does; as secureblue, an immutable atomic distro that’s hardened by default, required this commit to mitigate it once and for all.

While Bazzite and its atomic brethren do provide some additional protection against attacks, it’s often very overstated 😅. Hence, it’s unsurprising that it doesn’t provide any defense against this assault.

It’s a positive thing, don’t be worried.

These vulns already existed. It’s possible the bad guys were already using them. This gets them out in the open and on their way to being resolved.

Just keep patches up to date with any modern and maintained distro and you’ll be grand.

With AI enabled bug hunting, you’re likely to see a blitz of vulnerabilities, followed by a significant reduction in vulnerabilities.

Yes, malicious folks are usin em – heck, Kali’s had AI integrations for a while on a bunch of its tools even, for pen testing. But devs writing code get em too, and those are the people we need to see using these sorts of workflows as it lets them clip a bunch of zero days.

I think Mozilla, as an example, had a recent patch that cleaned up something like 271 zero days? Anthropic taking their Mythos stuff to banks/govt was largely just a publicity thing to try and shut people up who were mocking claudes code, but also potentially because it’d found govt-placed backdoors that they wanted the gov to know were about to be exposed / patched. The USA’s alleged ability to “shut off” tech assets during raids in Venezuela and Iran, gets trickier if AI is exposing their back doors. Likely also why the US Administration is now saying they want to review AIs before they get released. Mythos definitely isn’t the only game in town for this sort of stuff – but the general idea that the dev teams will be shifting to using these tools for QA / writing more secure apps in the near future, is fairly valid. So I wouldn’t go too tinfoil hat-y on that front… though it is a period where we’ll see a need to patch aggressively, and to double check security configs etc.

This exploit appears to be inspired by the copy fail.

Should you be worried? Nah, You should not be installing untrusted software on your device. This isnt even the type of exploit that scares me. Your device gas to already be compromised for this exploit to succeed.

Supply chain attacks are what scare me.

if somebody has user access to your computer, they are already 95% there, so I am not worried about these priv escalation part of the last 5%

There is an LLM called mythos from Anthropic that is very good at finding vulnerabilities.

How is finding vulnerabilities and patching them enshittification?

I feel like you don’t even know what enshittification is.

Not really. Proprietary software have just as many if not more vulnerabilities. Linux is just more honest and open about reporting them so it seems like they have more.

Not sure the term applies here. Enshittification is about companies making products worse on purpose for profit.

The vulnerability has been there for years so if it’s enshittified it has been for years as well.

No?