Aiyakami/rust_dirtyfrag

GitHubRepository PoCExploit

PoC files

9 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Rust exploit for CVE-2026-43284 that leverages an ESP in-place decryption vulnerability on shared SKB fragments to overwrite /usr/bin/su with attacker-controlled shellcode, achieving local privilege escalation.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Rust translation of a Linux kernel exploit targeting CVE-2026-43284. The code uses XFRM netlink messages and splice/vmsplice syscalls to corrupt the page cache of /usr/bin/su with an embedded shellcode payload. All behavior is consistent with the stated exploit goal; no concealed backdoor, credential theft, persistence, or unrelated payload is observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesRust
Target softwareLinux kernel
Attack typesprivilege escalationmemory corruption
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2026-43284 by crafting network packets that cause the kernel to decrypt data in-place over shared fragments, corrupting a target binary's page cache with attacker-supplied shellcode. It includes full payload delivery, verification, and instructions to trigger the modified binary.

src/main.rs:1-2src/main.rs:518-644src/main.rs:671-708src/main.rs:763-764

Requirements

  • Local unprivileged user access to a vulnerable Linux kernel (4.11 through unpatched versions).src/main.rs:1-2
  • Ability to create user and network namespaces (unshare CLONE_NEWUSER | CLONE_NEWNET).src/main.rs:291-301
  • Target file /usr/bin/su must exist and be writable via page-cache manipulation.src/main.rs:33

Observed behavior

  • Creates a new user and network namespace, then configures the loopback interface.src/main.rs:291-350
  • Installs 48 XFRM SAs with crafted ESN replay sequence high values encoding shellcode bytes.src/main.rs:676-691
  • Uses vmsplice and splice to send ESP-in-UDP packets with shared pipe pages, triggering in-place decryption that corrupts the target file's page cache.src/main.rs:518-644
  • Verifies that /usr/bin/su has been overwritten with shellcode at the expected entry point offset.src/main.rs:755-761
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Target
/usr/bin/suThe exploit overwrites the page cache of /usr/bin/su with shellcode.src/main.rs:33src/main.rs:671-708
Shellcode Payload
SHELL_ELF static arrayThe payload is an ELF shellcode that executes /bin/sh with TERM=xterm.src/main.rs:54-67
Exploit Technique
XFRM SA installation and splice/vmsplice corruptionThe exploit installs XFRM SAs with crafted seq_hi values and uses vmsplice/splice to trigger in-place decryption on shared frags, corrupting the target file's page cache.src/main.rs:364-516src/main.rs:518-645
Review boundaries

What the analysis did not establish

  • One binary file (.DS_Store) was not inspected; it is a macOS metadata file and unlikely to contain exploit logic.
  • Four text files (e.g., .gitignore, Cargo.lock) were omitted from content but their metadata is present; they are standard project files and unlikely to alter classification.
  • The evidence includes a screenshot referenced in readme.md that was not provided as text; it is described as showing test output and does not affect classification.
  • One binary file (.DS_Store) was flagged as metadata-only and not analyzed; it is a macOS directory metadata file and unlikely to contain executable logic.
  • Four text files without content were omitted from the packet; their paths are not disclosed, so their content cannot be reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1