Fragnesia Linux Kernel Flaw Enables Local Privilege Escalation to Root

Summary

Fragnesia is a Linux kernel flaw in XFRM ESP-in-TCP that lets unprivileged local attackers corrupt read-only file contents in the page cache and gain root. Vendor patches are recommended; restricting unprivileged user namespaces may partially mitigate risk.

Key points

The flaw affects the Linux kernel’s XFRM ESP-in-TCP subsystem and is described as an unintended side effect of a patch for DirtyFrag.
It exploits improper handling of shared page fragments during skb coalescing, enabling controlled corruption of file-backed page-cache contents.
Attackers can use user and network namespaces to obtain CAP_NET_ADMIN within an isolated namespace and configure a crafted ESP security association.
Researchers demonstrated modifying the in-memory contents of /usr/bin/su to obtain a root shell; the on-disk binary is not changed.
AppArmor restrictions on unprivileged user namespaces may provide partial mitigation, but additional bypasses may be needed.
Apply vendor kernel patches when available; meanwhile, disable esp4, esp6, and rxrpc if not required and restrict unprivileged user namespaces where feasible.
If exploitation is suspected, the article recommends rebooting or clearing the page cache.

Article Details

Vulnerability Types: Linux kernel logic flaw involving improper handling of shared page fragments during skb coalescing, enabling local privilege escalation through page-cache corruption
Exploitation Status: reported
Exploit Availability: unknown
Patch Status: unavailable
Workarounds: Disable the esp4, esp6, and rxrpc modules if they are not required.
Restrict or disable unprivileged user namespaces where operationally feasible.
AppArmor restrictions on unprivileged user namespaces may provide partial mitigation.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe demonstrated local exploit corrupts cached file contents to obtain root privileges.

People

Hyunwoo KimIdentified as the researcher who discovered Dirty Frag; the article attributes the explanation of Fragnesia’s origin to him.

Products

AppArmorshell. The modification exists only in page cache memory and does not alter the on-disk binary. Usage of AppArmor restrictions on unprivileged user namespaces, such as those default in Ubuntu, may serve as a partial Linux kernelResearchers have disclosed a new variant in the DirtyFrag family of Linux local privilege escalation (LPE) vulnerabilities, named “Fragnesia.” The vulnerability impacts the Linux kernel’s XFRM ESP-in-TCP subsystem.Wiz Threat Intel CenterWiz customers can use the pre-built queries and advisory in the Wiz Threat Intel Center to search for relevant instances in their environment. Wiz Research will continue to update that advisory as the situation develops.