Dirty Frag: Yet Another Universal Linux Kernel Privilege Escalation Vulnerability Active Since 2017, Unaffected By “Copy Fail” Mitigations

Here we go again…

Another Linux kernel privilege escalation vulnerability like "Copy Fail" that allows escalation to root reliably on all major Linux distros since 2017. This time it doesn't rely on the algif_aead kernel module, so it works even if you have a kernel with the Copy Fail mitigations.

This one's also a true zero day in that at the time of announcement, no fixes have been made upstream. The embargo on public disclosure was broken when an unrelated third party revealed the details and it seems like it was being exploited in the wild forcing everyone to step outside the coordinated disclosure timeline and announce this.

There is one silver lining: this one requires the CAP_NET_ADMIN capability, which is less likely in hardened container environments, e.g. K8s with default seccomp profiles.