g0thamRabb1t/CVE-2026-43284-dirtyfrag-detection

GitHubRepository PoCWriteup

PoC files

32 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The repository is a technical writeup documenting a controlled lab validation of the public DirtyFrag PoC for CVE-2026-43284. It describes the test environment, observed auditd events, and provides SOC detection logic and SIEM correlation rules. It does not contain exploit or scanner code; the README states the focus is on documenting audit log visibility, not providing an exploitation guide.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and generate-system-info-table.sh) are documentation and a system information collection script. They describe a CVE-2026-43284 PoC validation, auditd detection logic, and SOC recommendations. No backdoor, deceptive payload, or concealed harmful behavior is present in the supplied text.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
Languagesmarkdownshell
Target softwareLinux kernelXFRM/ESP
Attack typeslocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a writeup because it provides substantive technical analysis of CVE-2026-43284 exploitation visibility in audit logs, including a reconstructed event chain and detection logic, without containing any exploit or scanner code. The README explicitly states the focus is on documenting audit log events, not providing an exploitation guide.

README.md:5README.md:89-129

Requirements

  • Local unprivileged user access to a vulnerable Linux kernel (4.11 through unpatched versions) with ESP/IPsec modules available.README.md:15-17

Observed behavior

  • The README describes a test where a normal user executed a PoC (./exp) and obtained a root shell, confirmed via whoami and id.README.md:49
  • The artifact provides auditd detection logic, including a reconstructed event chain and an example SIEM correlation rule, but does not include the PoC code itself.README.md:89-129
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://github.com/V4bel/dirtyfragExternal reference to a public PoC repository; not part of the reviewed artifact code.README.md:25
Review boundaries

What the analysis did not establish

  • Two binary PDF reports (reports/DirtyFrag_CVE-2026-43284_EN.pdf, reports/DirtyFrag_CVE-2026-43284_PL.pdf) were not analyzed; their content could contain additional technical details or code.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all repository files were inspected.
  • The actual PoC exploit code (./exp) referenced in the README is not present in the supplied text files.
  • Two binary PDF files (reports/DirtyFrag_CVE-2026-43284_EN.pdf, reports/DirtyFrag_CVE-2026-43284_PL.pdf) and 21 other files were not inspected; their content could contain malicious payloads not visible in the supplied text.
  • The artifact references an external PoC repository (https://github.com/V4bel/dirtyfrag) which was not reviewed; the verdict covers only the supplied evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1