DirtyFrag Scanner & Patcher

Internal Network Tool for CVE-2026-43284 & CVE-2026-43500

Automated Linux LPE Audit & Mitigation via SSH

Disclaimer: This tool is specifically designed for legitimate internal security audits. Using it without authorization against systems that are not yours is a violation. Developed by Gagaltotal666 - GhostGTR666.

---

Table of Contents

• CVE Background
• Key Features
• Installation & Requirements
• Usage
• Command Options
• Mitigation & Authentication Mechanism
• Mitigation Process
• Example Output
• JSON Report Export
• Troubleshooting
• Real-World Scenarios

---

CVE Background

This tool identifies and mitigates two Local Privilege Escalation (LPE) vulnerabilities in the Linux kernel:

CVE-2026-43284 (xfrm-ESP Page-Cache Write)

• Vulnerability in the esp4 and esp6 modules that allows arbitrary writes to the page-cache
• Upstream patch available in kernel ≥ 6.15 (Commit f4c50a4034e6 from 2026-05-05)
• Distro backports may be lagging or unavailable
• Mitigation: Blacklist modules via /etc/modprobe.d/

CVE-2026-43500 (RxRPC Page-Cache Write)

• Similar vulnerability in the rxrpc module
• As of now (May 2026) no upstream patch exists
• The only available mitigation: blacklisting the module
• Upstream patch is still under review

---

Key Features

Feature	Description
Multi-Host Scanner	Scan entire subnets (CIDR) or specific IP lists in parallel
TCP Ping Discovery	Automatic detection of active hosts before SSH (can be skipped with --skip-discovery)
Deep Audit	Analysis of kernel version, module status, upstream patch, privilege level
Vulnerability Assessment	Automatic status classification: VULNERABLE, MITIGATED, LIKELY_PATCHED, POSSIBLY_SAFE, MODULE_NOT_LOADED
Automated Mitigation	Blacklist modules, unload, and flush page-cache with a single --patch
Zero-Touch Sudo Injection	Auto-inject password via sudo -S — no NOPASSWD configuration needed
Smart Auth Detection	Automatic detection of privilege escalation (root, sudo NOPASSWD, sudo with password)
CLI Validation	Pre-check for typos, SSH key file validation (prevents fake known_hosts)
Parallel Execution	Thread pool for scanning and SSH operations (default 20 workers)
JSON Reporting	Export complete audit results to JSON format
Pretty Output	Colored output + PrettyTable summary (auto-fallback if library is missing)
Signal Handling	Graceful shutdown via SIGINT/SIGTERM

---

Installation & Requirements

Requirements

Python 3.8 or higher
Libraries: paramiko, colorama, prettytable

Virtual/VENV

python3 -m venv .venv
source .venv/bin/activate

Setup

# Clone repository
git clone https://github.com/gagaltotal/dirtyfrag-scanner.git
cd dirtyfrag-scanner

# Install dependencies
pip install -r requirements.txt
# or
pip install paramiko colorama prettytable

---

Usage

1. Regular Scan (Audit Only, No Patch)

Detects vulnerabilities without changing anything on the target server.

# Using Password
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user ghostgtr666 --password 'server@02!'

# Using SSH Key
python3 dirtyfrag_scanner.py --subnet 10.134.205.0/24 --user root --key ~/.ssh/id_rsa

# Using both (password fallback if key fails)
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user admin --password 'pass' --key ~/.ssh/id_rsa

# Scan Specific IPs (without discovery)
python3 dirtyfrag_scanner.py --hosts 192.168.1.10,192.168.1.20 --user admin --password 'pass'

2. Scan & Patch (Automated Mitigation)

Runs the audit and immediately applies mitigation on vulnerable servers.

# Patch using Password (AUTO-INJECT SUDO, NO NOPASSWD NEEDED)
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user ghostgtr666 --password 'server@02!' --patch

# Patch using Root Login
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user root --key ~/.ssh/id_rsa --patch

# Patch with custom workers (faster scanning)
python3 dirtyfrag_scanner.py --subnet 192.168.0.0/16 --user admin --password 'pass' --patch --workers 50

---

Command Options

Target Selection (required, choose one)

--subnet CIDR              Scan CIDR subnet (e.g., 192.168.1.0/24)
--hosts IP[,IP,...]       Scan specific IPs (comma-separated, no spaces)

Authentication (at least one required)

--user USERNAME            SSH username (required)
--password PASSWORD        SSH password (use quotes if special chars present)
--key PATH                 Path to SSH private key (e.g., ~/.ssh/id_rsa, NOT known_hosts!)

Connection

--port PORT                Custom SSH port (default: 22)
--timeout SECONDS          SSH connect timeout (default: 10, max: 300)
--skip-discovery          Skip TCP ping discovery, SSH directly to all IPs

Execution

--workers NUM              Number of parallel SSH workers (default: 20, min: 1, max: 100)
--patch                    Apply mitigation on vulnerable hosts
--output FILE              Save audit results to JSON file

---

Mitigation & Authentication Mechanism

This tool is designed to work across various SSH server environments without needing sudoers modifications:

Privilege Escalation Methods (auto-detected)

1. Root Direct (recommended)

   --user root --key ~/.ssh/id_rsa --patch
   

   • Executes commands directly without sudo
   • Fastest and most reliable

2. Sudo NOPASSWD

   --user ubuntu --key ~/.ssh/id_rsa --patch
   

   • Requires: /etc/sudoers already configured with NOPASSWD
   • Tool will automatically detect and use sudo -n

3. Sudo with Password Injection (Zero-Touch) ⭐

   --user ubuntu --password 'mypass' --patch
   

   • Works with standard /etc/sudoers: ALL=(ALL) ALL
   • Tool automatically injects password via sudo -S -p ''
   • No sudoers editing needed at all!

4. Hybrid (Key + Password)

   --user ubuntu --key ~/.ssh/id_rsa --password 'mypass' --patch
   

   • Tries key auth first, falls back to password if key fails
   • Password is also injected for sudo if needed

---

Mitigation Process

When the --patch flag is used, the tool executes the following steps sequentially:

1. Clean target path → Remove old /etc/modprobe.d/dirtyfrag.conf (if present)
2. Write modprobe config → Write blacklist rules to /etc/modprobe.d/dirtyfrag.conf:

   install esp4 /bin/false
   install esp6 /bin/false
   install rxrpc /bin/false
   

3. Verify config written → Ensure the file was written correctly
4. Set file permissions → chmod 644 on the config file
5. Unload esp4 module → rmmod esp4 (skip if not loaded)
6. Unload esp6 module → rmmod esp6 (skip if not loaded)
7. Unload rxrpc module → rmmod rxrpc (skip if not loaded)
8. Flush page cache → echo 3 > /proc/sys/vm/drop_caches
9. Final verify → Confirm all modules are unloaded and config is valid

Note: If modules are still loaded after rmmod, the user will be notified that a reboot may be required.

---

Example Output