# استنساخ المستودع
git clone https://github.com/grabesec/XCP_ng_CVE-2026-43284_tester.git
cd XCP_ng_CVE-2026-43284_tester

# تشغيل التشخيص (كمستخدم غير جذر للحصول على أقوى دليل)
python3 XCP_ng_CVE_2026_43284_tester.py

=================================================================
  XCP-ng Dirty Frag Diagnostic -- CVE-2026-43284
  xfrm-ESP Page-Cache Write / Local Privilege Escalation
=================================================================
  Kernel  : 4.19.0+1
  Host    : xcpng-prod-01
  PID     : 52306  |  UID: 1000
=================================================================

[Phase 0] Pre-flight environment checks
---------------------------------------------
[*] Unprivileged user namespaces : ALLOWED
[*] esp4 blacklist in modprobe.d  : NOT FOUND
[*] CVE-2026-43284 patch in kernel RPM : NOT FOUND

[Phase 1] Baseline esp4 module state
---------------------------------------------
[*] esp4 is DORMANT -- not currently loaded in the kernel.
    The autoload mechanism may fetch it on demand via XFRM.

[Phase 2] Attempting esp4 engagement from unprivileged namespace
---------------------------------------------
[*] Spawning child in isolated user+network namespace
    (unshare -U -n -r) -- simulating a non-root local attacker

[*] Child signal    : XFRM SA accepted by kernel
[*] esp4 refcount   : 0 (before)  ->  1 (now)
[*] /proc/modules   : esp4 16384 1 - Live 0xffffffffc0a12000

[Phase 3] Engineering verdict
=================================================================

  [!!!]  PROOF OF EXPOSURE -- CVE-2026-43284  [!!!]

  esp4 refcount increased: 0 -> 1

  An unprivileged process inside a user+network namespace
  successfully registered an XFRM Security Association and
  engaged the esp4 in-place decryption engine in the host
  kernel. This is the gate condition for CVE-2026-43284.

  XCP-ng-specific analysis:
    [FAIL] Kernel 4.19 carries the vulnerable code (since 4.14)
    [FAIL] User namespaces are open -- esp4 path is reachable
    [OK]   rxrpc.ko absent -- CVE-2026-43500 does not apply
    [FAIL] esp4 path alone is sufficient on this configuration

[Phase 0] Pre-flight environment checks
---------------------------------------------
[+] esp4 blacklist found in /etc/modprobe.d/
    Module-load mitigation appears to be in place.
...
[Phase 2] Attempting esp4 engagement from unprivileged namespace
---------------------------------------------
[+] XFRM state add was REJECTED by the kernel.
    The esp4 engine was not engaged from the namespace.

[RESULT] The namespace loophole did NOT grant esp4 access.

# فحص الحالة الحالية فقط (بدون تغييرات)
sudo ./mitigate.sh --check

# تطبيق التخفيف (يتوقف إذا تم كشف IPsec)
sudo ./mitigate.sh

# إزالة التخفيف (بعد تطبيق تصحيح النواة الرسمي)
sudo ./mitigate.sh --undo

echo 'install esp4 /bin/false' > /etc/modprobe.d/dirtyfrag-cve-2026-43284.conf
rmmod esp4 2>/dev/null || true
echo 3 > /proc/sys/vm/drop_caches

XCP_ng_CVE-2026-43284_tester/
├── XCP_ng_CVE_2026_43284_tester.py   # البرنامج النصي التشخيصي — قم بتشغيله أولاً
├── mitigate.sh                        # برنامج نصي للتخفيف مع كشف IPsec
├── README.md                          # هذا الملف — بداية سريعة ونظرة عامة
├── TECHNICAL.md                       # تحليل فني عميق — سلسلة الهجوم،
│                                      # لماذا لا نحتاج rxrpc على XCP-ng،
│                                      # شرح داخل البرنامج النصي
├── CHANGELOG.md                       # تاريخ الإصدارات
└── LICENSE                            # MIT