Dirty Frag: Unfixed Root Exploit Makes All Linux Systems Vulnerable Due to a broken embargo, this severe root exploit has no patches available for any Linux distribution. Ubuntu, RHEL, openSUSE... they're all vulnerable.

Can they please stop with these Friday zero day disclosures killing my weekend

Yeah tested it on my Devuan linux and it worked but the researcher has a mitigation for it on his github as you see in the screenshot it no longer works

again bad modules, not the kernel itself. mitigation; cat <<EOF | tee /etc/modprobe.d/disable-dirtyfrag.conf install esp4 /bin/false install esp6 /bin/false install rxrpc /bin/false EOF modprobe -r esp4 esp6 rxrpc 2>/dev/null sync && echo 3 | tee /proc/sys/vm/drop_caches

I got Grok 4.3 (beta) to look into it, can someone verify this fix? @grok 1 - Apply mitigation (blocks the exploit immediately according to Grok): sudo sh -c ' echo "install esp4 /bin/false" > /etc/modprobe.d/dirtyfrag.conf echo "install esp6 /bin/false" >> /etc/modprobe.d/dirtyfrag.conf echo "install rxrpc /bin/false" >> /etc/modprobe.d/dirtyfrag.conf ' 2 - To revert later (after the real kernel patch arrives): sudo rm /etc/modprobe.d/dirtyfrag.conf sudo apt update && sudo apt upgrade sudo reboot

The risk is low. The majority of people don't use the features in question.

For a moment I read "Dirty Fag" and couldn't stop laughing

Maybe if there was one guy who wasn't a DEI hire, he'd have heard about this when announced and patched it at kernel dot org.

What is a broken embargo?

Except I don't have those modules loaded in the first place and anyone who can load them can get root without much trouble anyway.

After testing I've found that "su" (and probably sudo) will instantly drop you into a root shell with no password prompt at all. If that is NOT happening right now you could theoretically create a snapshot of your system and in the case that becomes true, unplug the network, reboot and roll back your system. In the meantime don't click on suspicious shit

Brothers, it's time:

And I think I know why the embargo was "broken" almost instantly ... the fix is not loading modules that work with your VPN ... sooo ... either you shut down your VPN or take the chance of getting hacked. Very convenient for "nefarious govs" (all of them) so take your pick on which one broke the embargo

Windows is vulnerable as well. Physical security isn't a high priority across the board.

Who broke the embargo?

Not Android OS

Okay, but are drawings real Lunduke?

So, let's go back to Linux Kernel 4.9. 💀

Lmao ducky doing over time

Sounds like this was a plan made years ago?, Just so happens to be an issue now after the Kernels have been switched to Rust. Force everyone onto rust?

If you are gov and your servers running linux you have to disclose otherwise some other unknown party may hack your devices. Linux are most routers so not fixing it gives more problem potential then opportunities even for gov agencies. Only exception imo non-gov black hats.

source reference -

Well now, isn't that just peachy-keen?

PamDOORa backdoor actively exploits Linux PAM modules for persistent SSH credential theft in targeted campaigns. Compounds Dirty Frag's unpatched root access with broader systemic open-source auth risks and escalating malware sophistication.

It works on Alma Linux. This is very interesting for sure.

I was doing some searching on DirtyFrag, AlmaLinux has a Vulnerability test out

Not another “Saturday patch session” please 🙏🤦‍♂️

EdgeOS is totally stuffed they refuse to update the multiple CVEs ive reported already.

Am I getting this correct that even a system without any form of su or sudo could be vulnerable because all it takes is an existing root setuid binary, or possibly even any command to spawn a shell as root with an altered password?