Local Privilege Escalation Report — Dirty Frag

Student: Jonatan Claudio

1. Requirements

Methodology Summary

A vulnerability assessment was performed on a virtual machine running Kali Linux using a detection script for the Dirty Frag vulnerability, associated with the following CVEs:

• CVE-2026-43284
• CVE-2026-43500

Subsequently, a public Proof of Concept (PoC) written in C was executed to validate the possibility of performing a local privilege escalation from an unprivileged user to root.

The exploitation was carried out locally within the vulnerable virtual machine.

Findings with Screenshots and Code

Screenshots

1. Dirty Frag detector result

2. uname -r result

   

3. Exploit execution

   

Additional Notes

• The exploitation was performed in a controlled laboratory environment.
• The goal was to validate the vulnerability and understand the impact of a local privilege escalation.
• No tests were conducted against external or unauthorized systems.

2. Target: [127.0.0.1]

Example:

127.0.0.1

2.1 Vulnerability 1 — CVE-2026-43284

Description

The CVE-2026-43284 vulnerability affects the Linux kernel's IPsec ESP subsystem through a corruption related to Page-Cache Write.

The flaw allows an unprivileged local user to modify kernel-associated memory and eventually escalate privileges to gain root access.

This vulnerability affects Linux kernels from January 2017 to May 2026.

Exploitation Process

1. The Dirty Frag detector was downloaded.
2. The Python script was executed:

python3 dirty_frag_detect.py

3. The detector indicated the system was vulnerable.
4. The public PoC was downloaded and compiled:

gcc -O0 -Wall -o exp exp.c -lutil

5. The exploit was executed:

./exp

6. The exploit successfully granted root privileges.

Code

See repository.

2.2 Vulnerability 2 — CVE-2026-43500

Description

The CVE-2026-43500 vulnerability affects the Linux kernel's RxRPC subsystem.

The flaw allows modification of internal structures related to Page-Cache Write and facilitates the attainment of elevated privileges.

The Dirty Frag exploit combines this vulnerability with CVE-2026-43284 to increase exploit compatibility and effectiveness.

Exploitation Process

The exploit used a chain of vulnerabilities to cover limitations of different Linux distributions.

On systems where AppArmor restricts namespaces, the RxRPC vulnerability keeps the exploitation viable.

The final result was gaining root access from an unprivileged user.

2.3 Steps (Methodology)

1. Enumeration

The following was identified:

• kernel version
• loaded modules
• user permissions
• active mitigations

Commands Used

uname -r

2. Vulnerability Discovery

The Dirty Frag detector was executed:

python3 dirty_frag_detect.py

The script confirmed:

• vulnerable kernel
• affected modules present
• possibility of local exploitation

3. Exploitation

The public exploit was compiled and executed:

gcc -O0 -Wall -o exp exp.c -lutil
./exp

4. Privilege Escalation

The exploit allowed obtaining:

uid=0(root)

Validation

whoami

3. Additional Elements

Relevant Findings

• Kali Linux was not explicitly listed in the official list of tested distributions; however, the kernel in use was still vulnerable.
• The exploitation was highly stable and did not rely on race conditions.
• The exploit worked from an unprivileged user.
• Dirty Frag represents a conceptual evolution of vulnerabilities such as Dirty Pipe.

Recommended Mitigation

Update the Linux kernel to a patched version.

As a temporary mitigation:

sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; echo 3 > /proc/sys/vm/drop_caches; true"

Technical Information

Impact

The vulnerability allows an unprivileged local user to gain full root access on the affected system.

This can allow:

• execution of privileged commands
• modification of system files
• persistence
• evasion of controls
• complete control of the operating system

Conclusion

The evaluated machine presented a critical local privilege escalation vulnerability via the Dirty Frag exploitation chain.

The exploitation was successful and allowed obtaining root access from an unprivileged user, demonstrating the critical impact of keeping Linux kernels outdated.

Final Note

The Python code was extracted from the repository: https://github.com/liamromanis101/DirtyFrag-Detector

The C exploitation code was extracted from the repository: https://github.com/V4bel/dirtyfrag/tree/master