Tag

Local Privilege Escalation

All articles tagged with #local privilege escalation

cyber-security-news3 months ago•57 min saved

Public PoC Reveals Local Root Exploit for DirtyDecrypt Linux Kernel

A public proof‑of‑concept exploit for the DirtyDecrypt (DirtyCBC) Linux kernel local privilege escalation (CVE-2026-31635) has been released. It exploits a missing copy-on-write guard in rxgk_decrypt_skb() within the RxGK subsystem, enabling a local unprivileged user to overwrite privileged memory (including /etc/shadow, sudoers, and SUID binaries) and gain root. The upstream patch was merged on April 25, 2026, and affected kernels require RXGK to be enabled (CONFIG_RXGK=y/m). Rolling‑release distributions with unpatched kernels (e.g., Fedora Rawhide, Arch before patch, openSUSE Tumbleweed) are at risk, while distros that ship RXGK disabled (e.g., some Debian/RHEL/Ubuntu builds) are less affected. In containers and Kubernetes environments, the flaw can lead to container escapes and host compromise. Mitigations include upgrading the kernel package and rebooting; as a temporary workaround, blacklisting rxrpc, esp4, and esp6 can be used at the expense of IPsec/AFS functionality. Kubernetes operators should rebuild worker images with patched kernels and enforce strict pod security settings.

via CyberSecurityNews|

#cve-2026-31635 #cyber-security-news #dirtydecrypt

technology3 months ago•4 min saved

DirtyDecrypt PoC Unleashed: Linux Kernel Local Privilege Escalation (CVE-2026-31635)

A newly released PoC for CVE-2026-31635, aka DirtyDecrypt, enables local privilege escalation in the Linux kernel by exploiting a missing copy-on-write guard in rxgk_decrypt_skb. The flaw affects systems with CONFIG_RXGK (e.g., Fedora, Arch, openSUSE) and can write to privileged memory or the kernel page cache, with potential container escape paths. It’s linked to the Dirty Frag/Copy Fail family of flaws, and mitigations being discussed include a kernel runtime killswitch and Rocky Linux’s opt-in security repository to push urgent fixes before upstream patches.

via The Hacker News|

#cve-2026-31635 #dirtydecrypt #linux-kernel

technology3 months ago•3 min saved

Public PoC Reveals PinTheft Arch Linux Root Privilege Flaw

A publicly released PoC demonstrates PinTheft, a Linux local privilege escalation in the RDS zerocopy path that can yield root on Arch Linux by pinning user pages and stealing FOLL_PIN references through io_uring fixed buffers; exploitation requires the RDS module to be loaded (default on Arch among common distros), io_uring enabled, a readable SUID-root binary, and x86_64 support, which limits its practical attack surface. Users should patch with the latest kernel, and as a mitigation can unload the RDS modules and disable them via modprobe.d (install rds /bin/false and install rds_tcp /bin/false) until patches are deployed.

via BleepingComputer|

#arch-linux #linux-kernel #local-privilege-escalation

security3 months ago•3 min saved

Dirty Frag LPE Chains Two Kernel Flaws to Root Across Major Linux Distros

Security researchers have disclosed Dirty Frag, a new unpatched Linux kernel local privilege escalation that chains two bugs—xfrm-ESP Page-Cache Write and RxRPC Page-Cache Write—to grant root on most distributions (e.g., Ubuntu 24.04.4, RHEL 10.1, Fedora 44). There is no CVE yet, and a working PoC exists; exploits are being weaponized in the wild. Patches are not yet available, so admins are advised to block esp4, esp6, and rxrpc modules until fixes arrive. The flaw sits in in-place decryption paths for paged fragments in esp4/esp6/rxrpc, allowing plaintext access and privilege escalation even if other mitigations like algif_aead are in use.

via The Hacker News|

#dirty-frag #linux-kernel #local-privilege-escalation

technology3 months ago•6 min saved

CopyFail exposes a universal Linux root exploit across containers and CI/CD

The CopyFail vulnerability (CVE-2026-31431) is a universal local privilege escalation in the Linux kernel that, with publicly released exploit code, can grant root across most distributions, threatening multi-tenant servers, Kubernetes containers, and CI/CD workflows; patches exist for some kernel versions, but many distros had not applied them when the exploit appeared, creating a dangerous zero-day patch gap that defenders are racing to mitigate.

via Ars Technica|

#copyfail #cve-2026-31431 #kubernetes