4 ms·
Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability
- bestouff 5mo agoLots of privilege escalations these days. But are there that many multiuser Linux systems nowadays ? I'm under the impression the whole landscape is either servers or single-user desktops (and ofc Android phones).
- INTPenis 5mo agoThe idea is that you can exploit a service hosted on Linux to run these.
- zahlman 5mo agoI impersonate multiple users on my machine for organizational reasons. LPEs also potentially make user-level malware into system-level malware, which is only marginally more impactful for a single person on a desktop, but considerably harder to clean up. (It also broadens the range of what such malware could exfiltrate from me.)
- dathinab 5mo ago> many multiuser Linux systems nowadays not relevant IMHO we don't live anymore in a time where you can trust that local apps do not misbehave, and in such a context LPE is pretty bad even in a single user system just thing about all the supply chain problems of recent times
- bestouff 5mo agoI would say that in a single-user system LPE isn't even needed. The moment you run malicious code all bets are off. No need to compromise the system when all your data is under "enemy" control.
- fluffybucktsnek 5mo agoTechnically, running malicious code doesn't necessarily give control over all your data in the device. But common Linux is still lacking in sandboxing practicality, so it might as well be that way.
- gnufx 5mo agoYou might not have root on an organizational "managed" system.
- riedel 5mo agoMany university HPC clusters are run multiuser. At least login nodes.
- gnufx 5mo agoAny university or national HPC system as I'd understand the term is multi-user. There are also things like the extensive high energy physics WLCG compute federation, which is somewhat different, but can potentially be compromised quickly at large scale. For the original copy-fail we didn't want to drain our WLCG Alma9 cluster, or just kill all the jobs like the university HPC system. We got eBPF mitigation in place within a couple of hours, relieved the exploit signature wasn't in logs from the night before. That would have been done earlier if Proofpoint hadn't bounced the forwarded oss-security article as "contains malware"; sigh.
- jovial_cavalier 5mo agoYes, lots of little web services and such run as unprivileged users, not root. I personally run a bunch of stuff as very restricted users in containers, with the threat model being that e.g. an RCE exploit in one of them will only affect the service, not the broader system.
- itintheory 5mo agoSounds like this one is in the same kernel modules as dirtyfrag, so the existing mitigations (if in place) are sufficient.
- chasil 5mo agoRedHat's mitigation is this: $ cat /etc/modprobe.d/dirtyfrag.conf install esp4 /bin/false install esp6 /bin/false install rxrpc /bin/false Are those correct for this exploit? https://access.redhat.com/security/vulnerabilities/RHSB-2026-003 https://access.redhat.com/security/vulnerabilities/RHSB-2026...
- LawnGnome 5mo agoI don't know, but the problem with blocking esp4 and esp6 is that IPsec stops working, as I understand it.
- cpach 5mo agoFor those who can I would recommend upgrading to Wireguard.
- itintheory 5mo agoYep, that's the advice from AWS for the previous set of vulnerabilities: https://aws.amazon.com/security/security-bulletins/2026-027-aws/ https://aws.amazon.com/security/security-bulletins/2026-027-... That one also includes disabling user namespaces. Could be problematic if they're in use.
- nubinetwork 5mo agoAt what point do we all start rolling our own microkernels? This is kind of getting silly now... 4 now in the past month?
- craftkiller 5mo agoI hate that the Qubes OS people were right.
- TMWNN 5mo agoUnRAID has released two point upgrades in the past two weeks because the previous AI-found vulnerabilities. Here we go again!
- gnufx 5mo agoThe primary source, which says keep the dirtyfrag mitigations in place, is https://github.com/v12-security/pocs/tree/main/fragnesia https://github.com/v12-security/pocs/tree/main/fragnesia