Two vulnerabilities have been identified in the Linux kernel, similar in nature to the recently disclosed Copy Fail vulnerability, but manifesting in different subsystems — xfrm-ESP and RxRPC. The series of vulnerabilities has been given the codename Dirty Frag (also referred to as Copy Fail 2). These vulnerabilities allow an unprivileged user to gain root rights by overwriting process data in the page cache. An exploit is available that works on all current Linux distributions. Information about the vulnerability was disclosed before patches were published, but there is a workaround to block the issue.
Dirty Frag encompasses two distinct vulnerabilities: the first in the xfrm-ESP module, used to accelerate encryption operations in IPsec using the ESP (Encapsulating Security Payload) protocol, and the second in the RxRPC driver, which implements the AF_RXRPC socket family and the corresponding RPC protocol over UDP. Each vulnerability individually allows for root access. The vulnerability in xfrm-ESP has been present in the Linux kernel since January 2017, while the vulnerability in RxRPC has existed since June 2023. Both issues are caused by optimizations allowing direct writes to the page cache.
To exploit the vulnerability in xfrm-ESP, the user must have permissions to create namespace spaces, and to exploit the vulnerability in RxRPC, there must be the ability to load the kernel module rxrpc.ko. For example, in Ubuntu, AppArmor rules prevent unprivileged users from creating namespace spaces, but the rxrpc.ko module is loaded by default. Some distributions lack the rxrpc.ko module, but do not block the creation of namespace spaces. The researcher who identified the issue has prepared a combined exploit capable of attacking the system through both vulnerabilities, allowing it to exploit the problem across all major distributions. The exploit has been confirmed to work on Ubuntu 24.04.4 with kernel 6.17.0-23, RHEL 10.1 with kernel 6.12.0-124.49.1, openSUSE Tumbleweed with kernel 7.0.2-1, CentOS Stream 10 with kernel 6.12.0-224, AlmaLinux 10 with kernel 6.12.0-124.52.3, and Fedora 44 with kernel 6.19.14-300.
As with the Copy Fail vulnerability, the issues in xfrm-ESP and RxRPC are caused by the decryption of data in place using the splice() function, which transfers data between file descriptors and pipes without copying by passing references to elements in the page cache. Offsets for write operations were calculated without proper checks considering the direct reference to elements in the page cache, allowing specially crafted requests to overwrite 4 bytes at the chosen offset and modify the contents of any file in the page cache.
All read operations from files primarily return content from the page cache. In the event of data modification in the page cache, read operations from the file will return not the information actually stored on the storage device, but modified data. Exploiting the vulnerability involves altering the page cache for an executable file with the suid root flag. For example, to gain root privileges, one can read the executable file /usr/bin/su into the page cache, after which one can insert their code into the content loaded into the page cache from that file. The subsequent execution of the 'su' utility will load not the original executable file from the storage device into memory, but the modified copy from the page cache.
The disclosure of information about vulnerabilities and the coordinated release of updates to address the issues was scheduled for May 12, but due to information leaks, the details of the vulnerability had to be published before the fixes were released. At the end of April, patches for rxrpc, ipsec, and xfrm were published on the public netdev mailing list without mentioning that they were related to addressing the vulnerability. On May 5, the maintainer of the IPsec subsystem accepted a change with a proposed fix in the xfrm-esp module into the netdev git repository, the description of which largely mirrored the description of the problem that led to the Copy Fail vulnerability in the algif_aead module. One security researcher became interested in this fix, managed to create a working exploit, and published it without knowing that a disclosure embargo was in place regarding the problem until May 12.
Updates with fixes for the Linux kernel and kernel packages in distributions have not yet been released, but problem-solving patches are available — xfrm-esp and rxrpc. CVE identifiers have not been assigned, making it difficult to track package updates in distributions. As a workaround for protection, loading of the esp4, esp6, and rxrpc kernel modules can be blocked: sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"
Source: opennet.ru
