DirtyFrag (CVE-2026-43284) - Lab Detection Exercise Report

Classification: Internal Lab - CyberLAB
Date: 24 May 2026
Platform: Elastic Stack v9.4.1
Status: Detection Confirmed

Table of Contents

• A - Executive Summary
• B - Full Findings Report
  • 1. Objective and Threat Model
  • 2. Vulnerability Background
  • 3. Lab Environment
  • 4. Phase 1 - Pre-Execution Setup
  • 5. Phase 2 - Exploit Execution
  • 6. Phase 3 - Post-Exploitation Activity
  • 7. Phase 4 - Detection Engineering
  • 8. Detection Reference
  • 9. Key Findings Summary
  • 10. References

A - Executive Summary

What Was Tested

A controlled exploitation exercise simulating a post-initial-access adversary using DirtyFrag (CVE-2026-43284), a Linux kernel privilege escalation vulnerability. The simulated attacker scenario: low-privilege user (saskia, uid=1001) obtained via phished credentials attempts to escalate to root on an internal Linux host. The lab used a deliberately vulnerable Ubuntu machine (ubuntu-vuln, kernel 6.0.0-22-generic) isolated from production networks.

Result: Exploitation Succeeded - Detection Confirmed

The attacker achieved full root access (uid=0) within the lab environment. The Elastic Security detection stack generated 3 HIGH-severity alerts (risk score 73) correctly identifying the exploitation chain. However, detection required manual tuning - the out-of-the-box configuration had gaps that would have resulted in missed alerts.

Bottom line: Unpatched Linux hosts running kernel <= 6.x are vulnerable. If an attacker already has a low-privilege foothold, this exploit gives them full root silently and quickly, with no on-disk trace visible to file integrity tools.

Risk Statement

Key Findings

1. Default auditd rules produce no evidence. Without explicit syscall rules for socket, splice, and unshare, the exploit runs silently - no logs, no alerts. Default Elastic Agent deployment does not add these rules automatically.
2. Detection required rule tuning. The published Elastic Security Labs detection logic used process.parent.pid as the correlation key. In practice, DirtyFrag forks intermediate processes, breaking that correlation. The fix - correlating by auditd.session - was identified and implemented during this exercise.
3. Post-exploitation actions were extensive. After gaining root, the attacker read /etc/shadow, accessed SSH authorized keys, wrote a persistence marker (/root/pwned.txt), and initiated network reconnaissance via nc. All occurred within 30 minutes of initial access.

Recommendations

B - Full Findings Report

1. Objective and Threat Model

Objective: Validate detection coverage for DirtyFrag exploitation in the home lab SOC, identify detection gaps, and produce a corrected detection rule grounded in observed attacker behaviour.

Threat model: Simulated post-initial-access adversary with phished credentials for a low-privilege user account (saskia, uid=1001). Goal: privilege escalation to root via DirtyFrag using the xfrm-ESP receive path. Lab execution performed via Proxmox console - functionally equivalent to SSH post-access.

Two attacker capability tiers were considered:

• Vanilla (noisy): exploit run without any evasion
• Evasive (quiet): reduced noise, deliberate cleanup

This exercise covered the vanilla tier.

2. Vulnerability Background

DirtyFrag is the third in a family of related Linux kernel bugs that all abuse the same root cause:

Root cause: IPv4/IPv6 datagram append paths did not set SKBFL_SHARED_FRAG after skb_splice_from_iter() planted a page cache page into a socket buffer (sk_buff). The ESP input path then performed in-place crypto on attacker-controlled page cache pages, treating them as ordinary uncloned non-linear skbs.

Exploit primitive: 4 or 8-byte controlled write into the page cache. Deterministic - no race condition required.

Exploit chain:

1. Attacker reads target binary (e.g. /usr/bin/su) into page cache
2. Constructs a packet via splice() so the file's page sits in frag[0] of struct sk_buff
3. Kernel delivers packet to xfrm-ESP decrypt path
4. ESP performs in-place crypto - source and destination both point at attacker's page
5. Crypto writes attacker-controlled bytes into page cache
6. All subsequent reads of the file - including kernel execve() - return corrupted bytes

Critical evasion property: The on-disk file is never modified. File integrity monitoring tools (AIDE, Tripwire, hash checks) all report the target file as clean.

Confirmed vulnerable distributions: Ubuntu 24.04.4, RHEL 10.1, AlmaLinux 10, openSUSE Tumbleweed, CentOS Stream 10, Fedora 44.

3. Lab Environment

Active telemetry at exercise time:

4. Phase 1 - Pre-Execution Setup

4.1 Lab Isolation

Lab network isolated before exercise. Firewall alias Cyber_escape_door confirmed disabled - preventing lateral reach to other VLANs or internet.

4.2 Victim Host Verification

Confirmed vulnerable kernel and low-privilege account on ubuntu-vuln:

saskia@ubuntu-vuln:~$ uname -r
6.0.0-22-generic
saskia@ubuntu-vuln:~$ whoami
saskia
saskia@ubuntu-vuln:~$ id
uid=1001(saskia) gid=1001(saskia) groups=1001(saskia),27(sudo),100(users)

4.3 Stack Health Check

Suricata: running and capturing (systemctl status)

Kibana/Elasticsearch: green/healthy (API check)

VM snapshots taken before any changes

4.4 Network Capture

tcpdump started on Suricata host (emp6s19, snapshot length 262144 bytes) for full packet capture of 172.66.66.27 traffic.

5. Phase 2 - Exploit Execution

5.1 Staging

Exploit source (exp.c) from V4bel/dirtyfrag PoC staged on victim host.

ubuntu-vuln@ubuntu-vuln:~/dirtyfrag$ ls
exp  exp.c  README.md
ubuntu-vuln@ubuntu-vuln:~/dirtyfrag$ cp exp.c /tmp/exp/

Right-hand terminal shows the staged copy visible to user saskia.

5.2 Compilation

Compiled as root via sudo gcc (user saskia is in sudoers):

saskia@ubuntu-vuln:~$ sudo gcc -o /tmp/exp/clean_frag /tmp/exp/exp.c
saskia@ubuntu-vuln:~$ ls -la /tmp/exp/
-rwxr-xr-x  1 root  root   62320 May 24 12:18 clean_frag
-rw-rw-r--  1 ubuntu-vuln  ubuntu-vuln  67803 May 24 12:13 exp.c
saskia@ubuntu-vuln:~$ id
uid=1001(saskia) gid=1001(saskia) groups=1001(saskia),27(sudo),100(users)

Binary: ELF 64-bit LSB executable, x86-64, dynamically linked.

5.3 Execution - Root Gained

Exploit executed as saskia (uid=1001). The process (clean_frag, pid=4326) opened AF_RXRPC and AF_ALG sockets, then called splice() to plant the page cache page into the network buffer. In-place crypto on the ESP path wrote attacker-controlled bytes into the page cache. A child process (pid=4327) called unshare with a0=50000000 (CLONE_NEWUSER | CLONE_NEWNET) to obtain namespace-scoped capabilities.

saskia@ubuntu-vuln:~$ /tmp/exp/clean_frag
...
root@ubuntu-vuln:~# id
uid=0(root) gid=0(root) groups=0(root)
root@ubuntu-vuln:~# ls

Full root shell obtained at 12:22 CEST (10:22 UTC), 24 May 2026.

Auditd syscall sequence captured (UTC):

All events share auditd.session=2.

6. Phase 3 - Post-Exploitation Activity

All actions performed as root on ubuntu-vuln from ~12:22 CEST onward.

6.1 Persistence Marker

root@ubuntu-vuln:~# echo "Dirty Frag PoC executed at $(date)" > /root/pwned.txt
root@ubuntu-vuln:~# cat /root/pwned.txt
Dirty Frag PoC executed at Sun May 24 12:28:05 PM CEST 2026

6.2 Credential Access

root@ubuntu-vuln:~# cat /etc/shadow | head -2
root:*:19823:0:99999:7:::
daemon:*:19823:0:99999:7:::
root@ubuntu-vuln:~# cat /home/ubuntu-vuln/.ssh/authorized_keys
ssh-ed25519 AAAA[...]

Shadow file and SSH authorized keys accessed. In a real compromise this enables offline password cracking and persistent SSH backdoor access.

6.3 Network Reconnaissance

root@ubuntu-vuln:~# nc -vz 172.66.66.1 100-8000

Port scan of the lab gateway (172.66.66.1, ports 100-8000) executed from root context at 12:51 CEST. This demonstrates lateral movement capability and network mapping from an escalated session.

6.4 Suricata Network Visibility

Suricata captured 105 events associated with 172.66.66.27 across the exercise window (88 mdns, 17 flow). At the time the screenshot was taken (during the nc scan at ~12:53 CEST), 29 events were visible in the dashboard.

The DirtyFrag exploit itself is kernel-internal and produces no network signature - the escalation primitive generates no anomalous traffic on the wire. Suricata was engaged to collect pcaps of post-exploitation traffic and enumeration attempts rather than to detect the exploit itself.

The flow events cluster around the nc port scan window (10:50-11:10 UTC / 12:50-13:10 CEST).

7. Phase 4 - Detection Engineering

7.1 Detection Rules Deployed

Two EQL sequence rules were created in the Kibana Detection Engine based on the Elastic Security Labs article.

Rule 1 - AF_RXRPC or AF_ALG Socket with Splice Followed by Execution (did not fire - see gap below)

sequence with maxspan=60s
  [any where host.os.type == "linux" and
   (
    (event.category == "process" and auditd.data.syscall == "socket"
     and auditd.data.a0 in ("26", "21")) or
    (event.category == "process" and auditd.data.syscall == "splice") or
    (event.category == "network" and event.action == "bound-socket"
     and data_stream.dataset == "auditd_manager.auditd"
     and auditd.data.socket.family == "38")
   )
   and user.id != "0"] by process.pid, host.id, user.id with runs=10
  [process where host.os.type == "linux" and event.action == "executed" and
   (
     (user.effective.id == "0" and user.id != "0") or
     (process.name in ("bash", "sh", "zsh", "dash", "fish", "ksh", "busybox")
      and process.args in ("-c", "--command", "-ic", "-ci", "-cl", "-lc",
                            "-bash", "-sh", "-zsh", "-dash", "-fish", "-ksh"))
    )] by process.parent.pid, host.id, user.id

Rule 2 - Namespace Manipulation Followed by Privilege Escalation (fired after fix)

sequence by host.id, auditd.session with maxspan=30s
  [process where host.os.type == "linux"
   and auditd.data.syscall == "unshare"
   and auditd.data.a0 in ("10000000", "50000000", "70000000",
                           "10020000", "50020000", "70020000")
   and user.id != "0" and user.id != null]
  [process where host.os.type == "linux"
   and user.id == "0" and user.id != null
   and (process.name in ("bash", "sh", "zsh", "dash", "fish",
                          "ksh", "su", "sudo", "pkexec", "busybox", "mksh")
        or process.name like ("python*", "perl*", "ruby*", "php*", "lua*"))]

7.2 Initial Detection Gap - Missing Syscall Coverage

Rule 1 returned zero results. Default auditd configuration on ubuntu-vuln captured: write, bpf, openat, unshare only.

Missing: socket, splice, bind - the core exploit primitives.

Remediation: Added to /etc/audit/rules.d/dirtyfrag.rules:

-a always,exit -F arch=b64 -S socket -k socket_syscall
-a always,exit -F arch=b32 -S socketcall -k socket_syscall
-a always,exit -F arch=b64 -S splice -k splice-syscall
-a always,exit -F arch=b32 -S splice -k splice-syscall
-a always,exit -F arch=b64 -S unshare -k unshare-syscall
-a always,exit -F arch=b32 -S unshare -k unshare-syscall

272 new auditd events landed in Elasticsearch within seconds of the exploit run.

7.3 EQL Correlation Gap - Process Tree Fragmentation

Despite events being captured, Rule 2 returned 0 matches.

Root cause - actual process tree (from Elasticsearch):

The original rule correlated by process.parent.pid. The unshare event had ppid=4326, but the root shell had a different parent - DirtyFrag forks intermediate processes, breaking the correlation.

Fix: Correlate by auditd.session. All events in the exploit chain shared session=2, correctly linking the sequence regardless of fork depth.

7.4 Alert Result

3 HIGH-severity alerts, risk score 73, in Kibana Security - Alerts at 2026-05-24T10:25:57Z UTC (12:25:57 CEST).

• Rule: DirtyFrag - Namespace Manipulation Followed by Privilege Escalation
• Severity: High
• Risk score: 73
• Host: ubuntu-vuln

8. Detection Reference

MITRE ATT&CK Mapping

Key Syscall Values

KQL Reference Queries

All dirtyfrag-related auditd events:

data_stream.dataset: "auditd_manager.auditd" and auditd.summary.how: *dirtyfrag*

Namespace manipulation by non-root:

data_stream.dataset: "auditd_manager.auditd" and auditd.data.syscall: "unshare" and auditd.data.a0: "50000000"

Post-escalation root activity in same session:

data_stream.dataset: "auditd_manager.auditd" and user.id: "0" and auditd.session: "2"

All auditd events during exploit window:

data_stream.dataset: "auditd_manager.auditd" and @timestamp >= "2026-05-24T10:20:00Z" and @timestamp <= "2026-05-24T10:30:00Z"

Socket and splice syscalls from exploit process:

data_stream.dataset: "auditd_manager.auditd" and auditd.summary.how: "/tmp/exp/clean_frag"

9. Key Findings Summary

10. References

• Elastic Security Labs: Copy Fail and DirtyFrag: Linux Page Bugs in the Wild
• Public PoC: V4bel/dirtyfrag on GitHub
• MITRE ATT&CK: T1068 - Exploitation for Privilege Escalation
• MITRE ATT&CK: TA0004 - Privilege Escalation
• MITRE ATT&CK: T1003.008 - /etc/passwd and /etc/shadow