gagaltotal/CVE-2026-43284-CVE-2026-43500-scan

GitHubRepository PoCScanner

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python-based network scanner and mitigation tool named 'DirtyFrag Scanner & Patcher'. It audits Linux hosts over SSH for exposure to CVE-2026-43284 and CVE-2026-43500 by checking kernel versions and loaded kernel modules (esp4, esp6, rxrpc). It does not contain exploit code; its primary operation is detection and reporting, with an optional automated mitigation feature that blacklists vulnerable modules.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python script (dirtyfrag_scanner.py) that audits and mitigates two Linux kernel CVEs via SSH. The script performs standard vulnerability scanning and applies documented mitigations (module blacklisting, rmmod, page cache flush). No backdoor, concealed executable behavior, or unrelated payload was observed. The code is straightforward and its actions align with the stated purpose.

ClassificationScanner
Model confidence98%
AuthenticationRequired
LanguagesPython
Target softwareLinux kernel
Attack typeslocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary function is to scan remote Linux hosts for the presence of vulnerable kernel modules and report their status. It does not contain any code that exploits the vulnerabilities (e.g., triggering the page-cache write). The optional '--patch' feature applies a mitigation (module blacklisting), not an exploit. The README explicitly describes it as an 'Automated Linux LPE Audit & Mitigation' tool.

README.md:1-3dirtyfrag_scanner.py:1-8

Requirements

  • SSH credentials (password or private key) for target hostsdirtyfrag_scanner.py:228-231
  • Root or sudo privileges on target hosts for mitigationdirtyfrag_scanner.py:517-532

Observed behavior

  • Connects to target hosts via SSH and collects system information (kernel version, loaded modules, OS release)dirtyfrag_scanner.py:410-420
  • Assesses vulnerability status for CVE-2026-43284 by checking if esp4/esp6 modules are loaded and kernel version is below 6.15dirtyfrag_scanner.py:262-285
  • Assesses vulnerability status for CVE-2026-43500 by checking if the rxrpc module is loadeddirtyfrag_scanner.py:288-303
  • Optionally applies mitigation by writing a modprobe blacklist configuration and unloading vulnerable modulesdirtyfrag_scanner.py:469-509
  • Generates a summary report of scan results, including vulnerability status and mitigation successdirtyfrag_scanner.py:798-827
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Ssh Credential Handling
The script accepts SSH credentials (password, private key) via command-line arguments and uses them to connect to target hosts.This is necessary for the tool's stated purpose of remote auditing and mitigation. The credentials are used only for the declared SSH operations.dirtyfrag_scanner.py:96-108dirtyfrag_scanner.py:308-343
Privilege Escalation
The script detects and uses sudo with automatic password injection (sudo -S) to apply mitigations on non-root accounts.This is a documented feature for applying mitigations on systems where the user has sudo ALL=(ALL) ALL but not NOPASSWD. It is used only for the declared mitigation steps.dirtyfrag_scanner.py:384-407dirtyfrag_scanner.py:424-454
Remote Command Execution
The script executes commands on remote hosts via SSH, including writing to /etc/modprobe.d/, running rmmod, and flushing page cache.These commands are the documented mitigation steps for the CVEs. No commands outside the declared audit/mitigation scope were observed.dirtyfrag_scanner.py:469-509dirtyfrag_scanner.py:512-625
Review boundaries

What the analysis did not establish

  • One non-text media file (screenshot) was not analyzed; it is unlikely to contain executable code.
  • The evidence includes CVE context metadata but no independent verification of the vulnerabilities was performed.
  • Two files (a screenshot and an unclassified file) were present in the repository but not included as text evidence; their content is unknown.
  • The review is based solely on static analysis of the provided source code; no dynamic execution or network traffic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2