Dirty Frag Linux Flaw Raises Post-Compromise Risk

Summary

Dirty Frag refers to Linux local privilege escalation flaws tracked as CVE-2026-43284 and CVE-2026-43500 that allow a low-privileged user to obtain root access by abusing kernel networking and memory-fragment handling components, including esp4, esp6, and rxrpc. The exploit has been observed in real-world attacks where adversaries first gain an initial foothold through SSH access, web shells, container escapes, or compromised service accounts, then trigger the vulnerability with an ELF binary that invokes the su command. Once root privileges are obtained, attackers can disable security controls, alter logs, move laterally, and establish long-term persistence. The report describes a limited but active campaign using this technique.

Investigation

Microsoft Defender researchers observed a step-by-step intrusion chain in which an external actor first gained SSH access, opened an interactive shell, and staged an ELF binary named ./update. That binary immediately invoked su to escalate privileges, after which the attacker modified a GLPI LDAP authentication file, enumerated GLPI directories, deleted and read PHP session files, and exfiltrated session data. The activity aligned with Microsoft Defender alerts tied to suspicious SUID and SGID execution and potential Dirty Frag exploitation. The investigation remains ongoing as researchers continue to review new telemetry.

Mitigation

Security updates for CVE-2026-43284 were released on May 8, 2026, while a fix for CVE-2026-43500 was not yet available at the time of reporting. Recommended mitigations include disabling the vulnerable kernel modules rxrpc, esp4, and esp6 through modprobe configuration, reducing unnecessary local shell access, hardening containerized workloads, and clearing page caches after suspected exploitation attempts. Organizations should also prioritize kernel patch deployment and verify the integrity of critical files following any suspected compromise.

Response

Defenders should detect unusual use of the su command, loading of the esp4, esp6, or rxrpc modules, and execution of unknown ELF binaries in privileged contexts. Applying the latest kernel updates promptly remains critical. Additional controls should include least-privilege enforcement for local accounts, tighter SSH key management, and file integrity monitoring for sensitive files such as GLPI LDAP authentication configurations. If exploitation is suspected, teams should clear caches, unload the affected modules, and perform forensic analysis of both memory and filesystem artifacts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (T1548) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Preparation – Drop the malicious ELF:
     The attacker, operating with a low‑privilege account, creates a crafted ELF binary named update that exploits the Dirty Frag vulnerability. In the lab we simulate this with a simple “hello world” ELF.

     cat <<'EOF' > update.c
     #include <stdio.h>
     int main() { printf("Malicious update executedn"); return 0; }
     EOF
     gcc -o update update.c
     chmod +x update

  2. Execution of the vulnerable binary:
     The attacker runs the ELF from the current directory, generating an execve event for ./update.

     ./update

  3. Privilege escalation – invoke su after the ELF:
     Immediately after the malicious ELF finishes, the attacker runs su to obtain a root shell, relying on the system’s misconfiguration that allows password‑less escalation (typical in vulnerable lab setups).

     su -c "id"

     The command line su -c "id" contains the literal ./update as part of the same session (the detection rule only checks for proc.cmdline|contains: './update' within the same su process). To satisfy the rule, we embed the path in the su command line itself:

     su -c "./update && id"

     This concatenates the malicious ELF execution and the privilege‑escalation request in a single su invocation, producing the exact telemetry the rule expects.

• Regression Test Script:

  #!/usr/bin/env bash
  # ------------------------------------------------------------
  # Simulates Dirty Frag / Copy Fail privilege escalation chain
  # ------------------------------------------------------------
  
  set -euo pipefail
  
  # 1. Build a dummy ELF binary named 'update'
  cat <<'EOF' > update.c
  #include <stdio.h>
  int main() { printf("Simulated malicious updaten"); return 0; }
  EOF
  gcc -o update update.c
  chmod +x update
  
  # 2. Execute the ELF (generates a normal execve event)
  echo "[*] Running malicious ELF ./update"
  ./update
  
  # 3. Trigger the detection condition: su with cmdline containing './update'
  echo "[*] Invoking su to elevate privileges while referencing './update'"
  # Note: In many lab environments 'su' may be configured without a password.
  su -c "./update && id"
  
  # 4. Cleanup (handled separately)

• Cleanup Commands:

  #!/usr/bin/env bash
  # ------------------------------------------------------------
  # Cleanup artifacts created by the simulation script
  # ------------------------------------------------------------
  
  set -euo pipefail
  
  echo "[*] Removing simulated ELF binary and source file"
  rm -f update update.c
  
  echo "[*] Cleanup complete"