0xBlackash/CVE-2026-43503

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A C exploit for CVE-2026-43503 (DirtyClone) that achieves local privilege escalation by corrupting the page cache of /usr/bin/su. It uses user and network namespaces, XFRM SAs, and UDP-encapsulated ESP to trigger the vulnerability and write a shellcode ELF payload into the target file, then executes the modified su to spawn a root shell.

Backdoor review

No backdoor observed in reviewed code

The PoC exploits CVE-2026-43503 to patch /usr/bin/su page-cache with a shell-spawning ELF payload for local privilege escalation. No backdoor, concealed operator-directed harm, or unrelated payload was observed. The code performs only the advertised exploit behavior.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesC
Target softwareLinux kernel/usr/bin/su
Attack typeslocal privilege escalationpage cache corruption
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The C source code implements a full privilege escalation chain: it sets up namespaces, installs crafted XFRM SAs, triggers the vulnerability via network operations to corrupt the page cache of /usr/bin/su with a shellcode payload, verifies the corruption, and executes the patched binary to gain root. This is active exploitation, not mere detection or scanning.

CVE-2026-43503.c:319-336CVE-2026-43503.c:258-287

Requirements

  • Local unprivileged user accessCVE-2026-43503.c:324-327
  • User namespaces enabled (unshare CLONE_NEWUSER)CVE-2026-43503.c:74
  • Network namespaces enabled (unshare CLONE_NEWNET)CVE-2026-43503.c:74
  • Vulnerable Linux kernel version (3.9 through unpatched)README.md:151-162
  • Target file /usr/bin/su must exist and be readableCVE-2026-43503.c:37

Observed behavior

  • Creates user and network namespaces and configures loopback interfaceCVE-2026-43503.c:70-96
  • Installs 48 XFRM SAs with crafted seq_hi values encoding a shellcode ELF payloadCVE-2026-43503.c:263-274
  • Sends UDP-encapsulated ESP packets using vmsplice/splice to trigger the vulnerability and corrupt the page cache of /usr/bin/suCVE-2026-43503.c:196-246
  • Verifies the first two bytes of the patched file at offset 0x78 match the shellcodeCVE-2026-43503.c:310-314
  • Executes the modified /usr/bin/su to spawn a root shellCVE-2026-43503.c:330-333
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Target
/usr/bin/suThe exploit writes a shell-spawning ELF payload into the page cache of /usr/bin/su to achieve local privilege escalation.CVE-2026-43503.c:37CVE-2026-43503.c:280
Payload
shell_elf byte arrayA 192-byte ELF payload that executes /bin/sh via execve is embedded in the exploit and written to the target binary's page cache.CVE-2026-43503.c:42-55
Exploit Technique
xfrm SA replay sequence hi field used to encode payload bytesThe exploit encodes each 4-byte chunk of the shell_elf payload into the seq_hi field of XFRM replay state ESN SAs, then triggers writes via ESP input.CVE-2026-43503.c:263-269CVE-2026-43503.c:170-180
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied source code and README; no runtime logs, build artifacts, or target environment details are provided.
  • The exploit's reliability and exact kernel version dependencies cannot be verified from static analysis alone.
  • Only the two text files (CVE-2026-43503.c and README.md) were reviewed; no binary files were present or analyzed.
  • The review does not assess whether the exploit works as claimed or is safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1