Fragnesia: New Linux Privilege Escalation Exploit

submitted by

https://github.com/v12-security/pocs/tree/main/fragnesia

Comments

25
2
4

Log in to comment

Hot Top New Old

Comments in root@0xdd.org.ru

@histrio@0xdd.org.ru It becomes hard to keep up. No patches, exploit straight to the public #fragnesia

 reply
1
OP

Ubuntu seems to be fine

Ubuntu note: AppArmor restricts unprivileged user namespaces by default.

 reply
1
OP

Confirmed for Almalinux 9

 reply
1

Comments in Linux@lemmy.ml

Good news. One fewer zero-day.

 reply
20

Same workaround works here as with dirty frag. Just disable those kernel modules.

 reply
14

Maybe the solution is to just, delete a bunch of kernel modules.

How many of them are actually important anyway?

 reply
6

Unless you deliberately set out to compile a minimalistic custom kernel, less than half of them. Problem is, you may not be able to easily tell which half.

 reply
2

I’m sure removing the root user will prevent all escalation exploits. Can’t get root if there is no root!

/j

 reply
13

If this is quickly solved, there is nothing to worry about

Sorry if my english is bad

 reply
15

It is already solved. The dirtyfrag patch fixes it already.

 reply
8

Only think you forgot was punctuation marks at the ends of your sentences.

 reply
5

This simply means the person isn’t finished talking.

 reply
15

what’s a scenario where you could suffer from this vulnerability?

 reply
6
OP

if somebody already has access to your machine, but doesn’t have root privileges

 reply
6

At this point we might as well just run everything as root anyway

 reply
6

Leave ssh root access open with no password. Attackers will try to escalate privileges as their default strategy, when that fails they’ll add your IP to their unhackable blacklist.

 reply
9

I think you might be able to deactivate this one by turning off XFRM support in a custom-configured kernel, at the cost of losing some types of tunneling. Not going to actually test that, though.

 reply
3

Scarry! Uoi guys on windows better stay away…ohhh privilege!

 reply
2

Comments in Linux@programming.dev

However, it is in the same surface and the mitigation is the same as for dirtyfrag.

phew

 reply
14
edited

Where’s the CVE? Was there an attempt at responsible disclosure? Was confidentiality breached? Did they coordinate this release with the devs like the dirtyfrag people did? This “announcement” doesn’t answer any of these questions and I am frustrated by it.

EDIT: Ok, there IS a CVE: https://security-tracker.debian.org/tracker/CVE-2026-46300

 reply
4
Insert image