Elastic Details Detection and Mitigation for Linux Copy Fail and DirtyFrag Bugs

Summary

Elastic Security Labs describes detection and mitigation for the Linux privilege-escalation bugs Copy Fail, Copy Fail 2, and DirtyFrag. Copy Fail is reported exploited in the wild; guidance includes syscall-based detection, kernel patching, and targeted hardening.

Key points

Copy Fail, Copy Fail 2, and DirtyFrag exploit Linux kernel page-cache corruption to enable local privilege escalation.
Copy Fail chains AF_ALG and splice() to create a controlled 4-byte page-cache write; it is reported exploited in the wild and listed in CISA’s Known Exploited Vulnerabilities catalog.
DirtyFrag has ESP and RxRPC exploit paths that can overwrite /usr/bin/su or corrupt /etc/passwd; it does not depend on the algif_aead module.
Elastic recommends detecting exploitation behavior, including socket and splice syscall patterns, namespace creation, and suspicious SUID binary execution.
The article includes Auditd rules and EQL and ES|QL queries to identify relevant syscall sequences and privilege escalation.
Mitigations include updating the Linux kernel, blocking affected modules, dropping the page cache, and restricting unprivileged user namespaces; the article notes potential service and compatibility impacts.

Article Details

Defense Focus: Detect exploitation behavior associated with Copy Fail and DirtyFrag—especially page-cache corruption primitives followed by privilege escalation—rather than relying on signatures for particular proof-of-concept implementations.
Detection Methods: Use auditd to detect socket syscalls with AF_ALG (26) or AF_RXRPC (21), splice calls from non-root processes, and bound-socket events with family 38; correlate these with a non-root process gaining effective UID 0.
For DirtyFrag, correlate unprivileged unshare calls that create user or network namespaces with subsequent root process execution or setuid(0).
Detect suspicious SUID program execution where the effective user or group is root but the real user or group is non-root, especially when the parent is a scripting runtime, shell one-liner, or executable from a user-writable path.
Proactively hunt for bursts of interleaved AF_ALG or AF_RXRPC socket activity and splice calls from the same non-root process.
Data Sources: Auditd syscall events for socket, splice, unshare, and bind
Auditd bound-socket events and socket-family data
Linux process execution events, including effective and real user/group IDs, parent process details, arguments, and executable paths
Linux host telemetry
Rule Types: Auditd syscall audit rules
EQL sequence correlation rules
ES|QL syscall aggregation query
Process-execution behavior detections
Platforms: Linux
Elastic Security
Defensive Actions: Update the Linux kernel when distribution patches are available.
If patching is not immediately possible, block the affected algif_aead module for Copy Fail and esp4, esp6, and rxrpc modules for DirtyFrag.
Drop the page cache after applying module-blocking mitigations to discard previously corrupted in-memory pages.
Restrict unprivileged user-namespace creation to reduce exposure to DirtyFrag and similar exploits.
Test mitigations in staging and assess compatibility before production deployment; module blocking and namespace restrictions may affect dependent services, and dropping the page cache can cause a brief I/O spike.