Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability

▲ Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability(phoronix.com)

35 points by mikece 5 hours ago | 14 comments

▲ gnufx 17 minutes ago | parent | next [-]

The primary source, which says keep the dirtyfrag mitigations in place, is https://github.com/v12-security/pocs/tree/main/fragnesia

▲ bestouff 4 hours ago | parent | prev | next [-]

Lots of privilege escalations these days. But are there that many multiuser Linux systems nowadays ? I'm under the impression the whole landscape is either servers or single-user desktops (and ofc Android phones).

▲

INTPenis 4 hours ago | parent | next [-]

The idea is that you can exploit a service hosted on Linux to run these.

▲

dathinab 3 hours ago | parent | prev | next [-]

> many multiuser Linux systems nowadays

not relevant IMHO

we don't live anymore in a time where you can trust that local apps do not misbehave, and in such a context LPE is pretty bad even in a single user system

just thing about all the supply chain problems of recent times

	▲	bestouff 2 hours ago \| parent [-]
		I would say that in a single-user system LPE isn't even needed. The moment you run malicious code all bets are off. No need to compromise the system when all your data is under "enemy" control.

▲

zahlman 4 hours ago | parent | prev | next [-]

I impersonate multiple users on my machine for organizational reasons.

LPEs also potentially make user-level malware into system-level malware, which is only marginally more impactful for a single person on a desktop, but considerably harder to clean up. (It also broadens the range of what such malware could exfiltrate from me.)

▲

riedel 3 hours ago | parent | prev [-]

Many university HPC clusters are run multiuser. At least login nodes.

▲ nubinetwork 4 hours ago | parent | prev | next [-]

At what point do we all start rolling our own microkernels? This is kind of getting silly now... 4 now in the past month?

	▲	craftkiller 3 hours ago \| parent [-]
		I hate that the Qubes OS people were right.

▲ itintheory 4 hours ago | parent | prev | next [-]

Sounds like this one is in the same kernel modules as dirtyfrag, so the existing mitigations (if in place) are sufficient.

▲ chasil 4 hours ago | parent [-]

RedHat's mitigation is this:

  $ cat /etc/modprobe.d/dirtyfrag.conf
  install esp4 /bin/false
  install esp6 /bin/false
  install rxrpc /bin/false

Are those correct for this exploit?

https://access.redhat.com/security/vulnerabilities/RHSB-2026...

	▲	itintheory 3 hours ago \| parent \| next [-]
		Yep, that's the advice from AWS for the previous set of vulnerabilities: https://aws.amazon.com/security/security-bulletins/2026-027-... That one also includes disabling user namespaces. Could be problematic if they're in use.
	▲	LawnGnome 3 hours ago \| parent \| prev [-]
		I don't know, but the problem with blocking esp4 and esp6 is that IPsec stops working, as I understand it.

▲ TMWNN 2 hours ago | parent | prev [-]

UnRAID has released two point upgrades in the past two weeks because the previous AI-found vulnerabilities. Here we go again!