gagaltotal/cve-2026-43284-cve-2026-43500-scanAutomated SSH-based scanner and patcher for Linux kernel LPE vulnerabilities CVE-2026-43284 and CVE-2026-43500, with multi-host discovery, privilege escalation detection, and module blacklisting mitigation.
Disclaimer: This tool is specifically designed for legitimate internal security audits. Using it without authorization against systems that are not yours is a violation. Developed by Gagaltotal666 - GhostGTR666.
This tool identifies and mitigates two Local Privilege Escalation (LPE) vulnerabilities in the Linux kernel:
f4c50a4034e6 from 2026-05-05)/etc/modprobe.d/| Feature | Description |
|---|---|
| Multi-Host Scanner | Scan entire subnets (CIDR) or specific IP lists in parallel |
| TCP Ping Discovery | Automatic detection of active hosts before SSH (can be skipped with --skip-discovery) |
| Deep Audit | Analysis of kernel version, module status, upstream patch, privilege level |
| Vulnerability Assessment | Automatic status classification: VULNERABLE, MITIGATED, LIKELY_PATCHED, POSSIBLY_SAFE, MODULE_NOT_LOADED |
| Automated Mitigation | Blacklist modules, unload, and flush page-cache with a single --patch |
| Zero-Touch Sudo Injection | Auto-inject password via sudo -S — no NOPASSWD configuration needed |
| Smart Auth Detection | Automatic detection of privilege escalation (root, sudo NOPASSWD, sudo with password) |
| CLI Validation | Pre-check for typos, SSH key file validation (prevents fake known_hosts) |
| Parallel Execution | Thread pool for scanning and SSH operations (default 20 workers) |
| JSON Reporting | Export complete audit results to JSON format |
| Pretty Output | Colored output + PrettyTable summary (auto-fallback if library is missing) |
| Signal Handling | Graceful shutdown via SIGINT/SIGTERM |
Python 3.8 or higher
Libraries: paramiko, colorama, prettytable
python3 -m venv .venv
source .venv/bin/activate
# Clone repository
git clone https://github.com/gagaltotal/dirtyfrag-scanner.git
cd dirtyfrag-scanner
# Install dependencies
pip install -r requirements.txt
# or
pip install paramiko colorama prettytable
Detects vulnerabilities without changing anything on the target server.
# Using Password
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user ghostgtr666 --password 'server@02!'
# Using SSH Key
python3 dirtyfrag_scanner.py --subnet 10.134.205.0/24 --user root --key ~/.ssh/id_rsa
# Using both (password fallback if key fails)
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user admin --password 'pass' --key ~/.ssh/id_rsa
# Scan Specific IPs (without discovery)
python3 dirtyfrag_scanner.py --hosts 192.168.1.10,192.168.1.20 --user admin --password 'pass'
Runs the audit and immediately applies mitigation on vulnerable servers.
# Patch using Password (AUTO-INJECT SUDO, NO NOPASSWD NEEDED)
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user ghostgtr666 --password 'server@02!' --patch
# Patch using Root Login
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user root --key ~/.ssh/id_rsa --patch
# Patch with custom workers (faster scanning)
python3 dirtyfrag_scanner.py --subnet 192.168.0.0/16 --user admin --password 'pass' --patch --workers 50
--subnet CIDR Scan CIDR subnet (e.g., 192.168.1.0/24)
--hosts IP[,IP,...] Scan specific IPs (comma-separated, no spaces)
--user USERNAME SSH username (required)
--password PASSWORD SSH password (use quotes if special chars present)
--key PATH Path to SSH private key (e.g., ~/.ssh/id_rsa, NOT known_hosts!)
--port PORT Custom SSH port (default: 22)
--timeout SECONDS SSH connect timeout (default: 10, max: 300)
--skip-discovery Skip TCP ping discovery, SSH directly to all IPs
--workers NUM Number of parallel SSH workers (default: 20, min: 1, max: 100)
--patch Apply mitigation on vulnerable hosts
--output FILE Save audit results to JSON file
This tool is designed to work across various SSH server environments without needing sudoers modifications:
Root Direct (recommended)
--user root --key ~/.ssh/id_rsa --patch
Sudo NOPASSWD
--user ubuntu --key ~/.ssh/id_rsa --patch
/etc/sudoers already configured with NOPASSWDsudo -nSudo with Password Injection (Zero-Touch) ⭐
--user ubuntu --password 'mypass' --patch
/etc/sudoers: ALL=(ALL) ALLsudo -S -p ''Hybrid (Key + Password)
--user ubuntu --key ~/.ssh/id_rsa --password 'mypass' --patch
When the --patch flag is used, the tool executes the following steps sequentially:
/etc/modprobe.d/dirtyfrag.conf (if present)/etc/modprobe.d/dirtyfrag.conf:
install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false
chmod 644 on the config filermmod esp4 (skip if not loaded)rmmod esp6 (skip if not loaded)rmmod rxrpc (skip if not loaded)echo 3 > /proc/sys/vm/drop_cachesNote: If modules are still loaded after rmmod, the user will be notified that a reboot may be required.
──────────────────────────────────────────────────────────
Host 1/2: 10.134.205.163 (ubuntu-web-01)
──────────────────────────────────────────────────────────
OS : Ubuntu 22.04.4 LTS
Kernel : 6.8.0-111-generic
Priv : user
CVE-2026-43284 (xfrm-ESP) [POSSIBLY_SAFE]
esp4 loaded : no
esp6 loaded : no
Mitigation : NOT applied
Upstream patch: NOT included (<6.15)
CVE-2026-43500 (RxRPC) [VULNERABLE]
rxrpc loaded : YES
Mitigation : NOT applied
Note: No upstream patch exists yet — mitigation is the ONLY fix
[✓] Mitigation applied successfully!
[Privilege check] OK (using: sudo (auto-pass))
[Clean target path] OK
[Write modprobe config] OK
[Verify config written] OK (3 entries)
[Set file permissions] OK
[Unload esp4 module] Skipped (not loaded or already removed)
[Unload esp6 module] Skipped (not loaded or already removed)
[Unload rxrpc module] Unloaded
[Flush page cache] OK
[Final verify] Config file valid
[Final verify] All vulnerable modules unloaded
[Result] Mitigation applied successfully
════ SUMMARY ════
+----------------+-------------------+------+------------+------------+----------+
| Host | OS/Kernel | Priv | CVE-43284 | CVE-43500 | Patched? |
+----------------+-------------------+------+------------+------------+----------+
| 10.134.205.163 | Ubuntu 22.04.4 | user | POSSIBLY_S | VULNERABLE | YES ✓ |
| 10.134.205.164 | Ubuntu 22.04.4 | user | VULNERABLE| VULNERABLE | FAILED ✗ |
| 10.134.205.165 | Debian 12 | root | MITIGATED | MITIGATED | — |
+----------------+-------------------+------+------------+------------+----------+
════ STATISTICS ════
Hosts scanned : 3
Errors : 0
Vulnerable 43284: 1
Vulnerable 43500: 2
Mitigations OK : 1
Mitigations FAIL: 1
└─ 1 failed due to insufficient privileges
Duration : 12.4s
Use the --output flag to save complete audit results:
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user admin --password 'pass' --output report.json
{
"scan_time": "2026-05-12 14:23:45",
"tool": "DirtyFrag Scanner v1.0",
"cves": ["CVE-2026-43284", "CVE-2026-43500"],
"total_hosts": 3,
"results": [
{
"host": "10.134.205.163",
"hostname": "ubuntu-web-01",
"os": "Ubuntu 22.04.4 LTS",
"kernel": "6.8.0-111-generic",
"kernel_v": [6, 8, 0],
"is_root": false,
"cve_43284": {
"status": "POSSIBLY_SAFE",
"esp4_loaded": false,
"esp6_loaded": false,
"mitigation_applied": false,
"upstream_patched": false
},
"cve_43500": {
"status": "VULNERABLE",
"rxrpc_loaded": true,
"mitigation_applied": false
},
"patch_applied": true,
"patch_msg": "...",
"error": null
}
]
}
# WRONG
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user root --key ~/.ssh/id_rsa.pub
# CORRECT (use private key, not .pub)
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user root --key ~/.ssh/id_rsa
The file you provided is not a private key. Check:
.pub file (public key)known_hosts-----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----# WRONG
python3 dirtyfrag_scanner.py --user ghostgtr666--password 'pass' --subnet 192.168.1.0/24
# CORRECT
python3 dirtyfrag_scanner.py --user ghostgtr666 --password 'pass' --subnet 192.168.1.0/24
User does not have sudo access, or password was not provided when needed:
# Option 1: Use root directly
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user root --key ~/.ssh/id_rsa --patch
# Option 2: Provide password for auto-inject sudo
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user admin --password 'pass' --patch
# Option 3: Configure NOPASSWD in /etc/sudoers
echo 'admin ALL=(ALL) NOPASSWD: ALL' | sudo tee -a /etc/sudoers
Increase --timeout:
python3 dirtyfrag_scanner.py --subnet 192.168.1.0/24 --user admin --password 'pass' --timeout 30
Some distros pre-compile kernels without esp4/esp6/rxrpc modules. Check manually:
# On the target host
cat /proc/cmdline | grep -i module
lsmod | grep -E 'esp4|esp6|rxrpc'
python3 dirtyfrag_scanner.py \
--subnet 192.168.100.0/24 \
--user monitoring \
--password 'monitoring123' \
--workers 30 \
--output full-audit.json
python3 dirtyfrag_scanner.py \
--subnet 10.0.0.0/16 \
--user root \
--key ~/.ssh/prod_rsa \
--patch \
--workers 50 \
--output emergency-patch.json
python3 dirtyfrag_scanner.py \
--hosts 192.168.1.10,192.168.1.20,192.168.1.30 \
--user ubuntu \
--key ~/.ssh/dev_rsa \
--output critical-servers.json
python3 dirtyfrag_scanner.py \
--subnet 192.168.50.0/24 \
--user deploy \
--key ~/.ssh/deploy_ed25519 \
--password 'deploy@backup' \
--patch \
--output deploy-scan.json
Developed by Gagaltotal666 - GhostGTR666
GitHub: github.com/gagaltotal
Disclaimer: This tool is only for legitimate and authorized security audits. Users are responsible for their use of this tool.