Unable to reproduce on many systems
V4bel/dirtyfrag
I've been testing out a few of my systems, both work and personal. They seem unaffected.
On the work Ubuntu 24.04 systems, both with AWS and generic kernels, I get
```
~/dirtyfrag $ uname -r
6.17.0-1023-aws
~/dirtyfrag $ ./exp
Password:
su: Authentication failure
```
```
~$ uname -r
6.8.0-111-generic
~/dirtyfrag $ ./exp
Password:
su: Authentication failure
```
**Update:** I was able to make it work by logging out from my SSH session for a while and logging in back in - seems like once it fails it needs a moment to recover. Maybe it needs to get the `su` binary out of page cache?
On my ArchLinux desktop:
```
max-p@desktop /t/dirtyfrag (master) [4]> uname -r
6.19.13-zen1-1-zen
max-p@desktop /t/dirtyfrag (master)> ./exp
dirtyfrag: failed (rc=4)
```
This one just never works, ran it dozens of times. Maybe `linux-zen` is not exploitable?
In all those cases I can definitely see XFRM and RXRPC being loaded in dmesg, but the exploit fails.
My other Arch machine with the regular `linux` package does appear exploitable:
```
max-p@nas ~/dirtyfrag (master)> uname -r
7.0.3-arch1-2
max-p@nas ~/dirtyfrag (master)> gcc -o exp -Wall -O0 -lutil exp.c
max-p@nas ~/dirtyfrag (master)> ./exp
[root@nas dirtyfrag]#
```
View on GitHub ↗
Other Comments / Reviews
Related Content
SaaS Metrics