|
| 1 | +# DirtyFrag Mitigation DaemonSet (CVE-2026-43284 + CVE-2026-43500) |
| 2 | +# |
| 3 | +# DirtyFrag = two related Linux kernel page-cache write LPEs in the IPv4/IPv6 |
| 4 | +# datagram zero-copy path. __ip_append_data() fails to set SKBFL_SHARED_FRAG |
| 5 | +# on splice-attached pages, then ESP (xfrm) and RxRPC perform in-place crypto |
| 6 | +# over them — mutating the page cache of read-only files like /usr/bin/su |
| 7 | +# and /etc/passwd. |
| 8 | +# - CVE-2026-43284: xfrm-ESP variant. Requires unshare(CLONE_NEWUSER| |
| 9 | +# CLONE_NEWNET) to acquire CAP_NET_ADMIN in a user namespace. |
| 10 | +# - CVE-2026-43500: RxRPC variant. Requires no privileges — but rxrpc.ko |
| 11 | +# is not built into the AL2023 default kernel (blacklisted defensively |
| 12 | +# per AWS bulletin 2026-027-AWS). |
| 13 | +# |
| 14 | +# Crosses container boundaries via the shared page cache, so on a multi-tenant |
| 15 | +# CI cluster any unprivileged workflow code can escalate to root on the node. |
| 16 | +# |
| 17 | +# AWS Security Bulletin: https://aws.amazon.com/security/security-bulletins/2026-027-aws/ |
| 18 | +# ALAS2023-2026-1694 (kernel 6.1, fixed in 6.1.170-210.320.amzn2023) |
| 19 | +# ALAS2023-2026-1695 (kernel 6.12, fixed in 6.12.83-113.160.amzn2023) |
| 20 | +# Released 2026-05-09. |
| 21 | +# |
| 22 | +# AS OF 2026-05-11, no patched EKS-optimized AMI exists yet (latest v20260505 |
| 23 | +# ships kernel 6.1.168 / 6.12.80 — both pre-patch). |
| 24 | +# |
| 25 | +# This DaemonSet writes /etc/modprobe.d/disable-dirtyfrag.conf to block |
| 26 | +# on-demand loading of esp4, esp6, and rxrpc, then defensively rmmod's any |
| 27 | +# that have already loaded, then drops the page cache to evict any |
| 28 | +# DirtyFrag-poisoned pages of read-only files. |
| 29 | +# |
| 30 | +# Runs on EVERY node (base infra + Karpenter ARC + BuildKit + GPU + H100/B200). |
| 31 | +# Same shape as algif-mitigation.yaml. |
| 32 | +# |
| 33 | +# REMOVE this DaemonSet once all nodes are running a patched AL2023 AMI |
| 34 | +# (kernel 6.1.170+ or 6.12.83+). |
| 35 | + |
| 36 | +--- |
| 37 | +apiVersion: v1 |
| 38 | +kind: ConfigMap |
| 39 | +metadata: |
| 40 | + name: dirtyfrag-mitigation-script |
| 41 | + namespace: kube-system |
| 42 | +data: |
| 43 | + disable-dirtyfrag.sh: | |
| 44 | + #!/bin/bash |
| 45 | + set -euo pipefail |
| 46 | +
|
| 47 | + echo "=== DirtyFrag Mitigation (CVE-2026-43284 + CVE-2026-43500) ===" |
| 48 | + echo "Node: $(hostname 2>/dev/null || echo 'unknown')" |
| 49 | + echo "Date: $(date)" |
| 50 | + echo "" |
| 51 | +
|
| 52 | + MARKER_FILE="/var/lib/dirtyfrag-mitigation/.configured" |
| 53 | + MODPROBE_FILE="/etc/modprobe.d/disable-dirtyfrag.conf" |
| 54 | + MODULES="esp4 esp6 rxrpc" |
| 55 | +
|
| 56 | + # ========================================================================= |
| 57 | + # Idempotency — re-verify on pod restart, skip rewrite if still in place |
| 58 | + # ========================================================================= |
| 59 | + if [ -f "$MARKER_FILE" ] && [ -f "$MODPROBE_FILE" ]; then |
| 60 | + echo "Already configured. Re-checking modules are not loaded..." |
| 61 | + for mod in $MODULES; do |
| 62 | + if lsmod | awk '{print $1}' | grep -qx "$mod"; then |
| 63 | + echo " WARNING: $mod is loaded despite blacklist. Unloading..." |
| 64 | + modprobe -r "$mod" || echo " rmmod $mod failed (module in use); reboot required for full mitigation." |
| 65 | + else |
| 66 | + echo " $mod not loaded — mitigation effective." |
| 67 | + fi |
| 68 | + done |
| 69 | + exit 0 |
| 70 | + fi |
| 71 | +
|
| 72 | + # ========================================================================= |
| 73 | + # Step 1 — install modprobe.d blacklist |
| 74 | + # ========================================================================= |
| 75 | + echo "[1/3] Writing $MODPROBE_FILE..." |
| 76 | + mkdir -p "$(dirname "$MODPROBE_FILE")" |
| 77 | + cat > "$MODPROBE_FILE" <<'EOF' |
| 78 | + # CVE-2026-43284 + CVE-2026-43500 ("DirtyFrag") — page-cache write LPE mitigation. |
| 79 | + # Redirects on-demand loading of esp4, esp6, and rxrpc to /bin/false so the |
| 80 | + # modules are never inserted into the running kernel. |
| 81 | + # Managed by base/kubernetes/dirtyfrag-mitigation.yaml DaemonSet. |
| 82 | + # Remove this file (and the DaemonSet) once nodes are running a patched |
| 83 | + # AL2023 kernel (6.1.170+ or 6.12.83+). |
| 84 | + install esp4 /bin/false |
| 85 | + install esp6 /bin/false |
| 86 | + install rxrpc /bin/false |
| 87 | + EOF |
| 88 | + echo " Wrote blacklist." |
| 89 | +
|
| 90 | + # ========================================================================= |
| 91 | + # Step 2 — unload modules if currently loaded (defensive, each individually) |
| 92 | + # ========================================================================= |
| 93 | + echo "[2/3] Checking if vulnerable modules are loaded..." |
| 94 | + for mod in $MODULES; do |
| 95 | + if lsmod | awk '{print $1}' | grep -qx "$mod"; then |
| 96 | + echo " $mod loaded. Unloading (modprobe -r)..." |
| 97 | + if modprobe -r "$mod"; then |
| 98 | + echo " Unloaded $mod." |
| 99 | + else |
| 100 | + echo " WARNING: rmmod $mod failed. Module may be in use. New attempts" |
| 101 | + echo " will be blocked from now on, but the vulnerable code path" |
| 102 | + echo " remains reachable until the node reboots." |
| 103 | + fi |
| 104 | + else |
| 105 | + echo " $mod not loaded." |
| 106 | + fi |
| 107 | + done |
| 108 | +
|
| 109 | + # ========================================================================= |
| 110 | + # Step 3 — drop page cache to evict any DirtyFrag-poisoned pages |
| 111 | + # ========================================================================= |
| 112 | + # Best-effort: only evicts unmapped clean pages. Pages currently mapped by |
| 113 | + # running processes (libc, sshd, /etc/passwd held open, etc.) cannot be |
| 114 | + # evicted this way and will retain any prior poisoning until the node |
| 115 | + # reboots or the holding process exits. |
| 116 | + echo "[3/3] Dropping page cache (echo 3 > /proc/sys/vm/drop_caches)..." |
| 117 | + echo 3 > /proc/sys/vm/drop_caches || echo " WARNING: drop_caches failed." |
| 118 | +
|
| 119 | + # Marker — written last so a partial run re-attempts on next pod start |
| 120 | + mkdir -p "$(dirname "$MARKER_FILE")" |
| 121 | + date -Iseconds 2>/dev/null > "$MARKER_FILE" || date > "$MARKER_FILE" |
| 122 | +
|
| 123 | + echo "" |
| 124 | + echo "=== Mitigation Applied ===" |
| 125 | + echo "Future kernel attempts to load esp4/esp6/rxrpc will be redirected to /bin/false." |
| 126 | +
|
| 127 | +--- |
| 128 | +apiVersion: apps/v1 |
| 129 | +kind: DaemonSet |
| 130 | +metadata: |
| 131 | + name: dirtyfrag-mitigation |
| 132 | + namespace: kube-system |
| 133 | + labels: |
| 134 | + app: dirtyfrag-mitigation |
| 135 | + app.kubernetes.io/name: dirtyfrag-mitigation |
| 136 | + app.kubernetes.io/component: node-configuration |
| 137 | +spec: |
| 138 | + selector: |
| 139 | + matchLabels: |
| 140 | + app: dirtyfrag-mitigation |
| 141 | + |
| 142 | + updateStrategy: |
| 143 | + type: RollingUpdate |
| 144 | + rollingUpdate: |
| 145 | + maxUnavailable: "25%" |
| 146 | + |
| 147 | + template: |
| 148 | + metadata: |
| 149 | + labels: |
| 150 | + app: dirtyfrag-mitigation |
| 151 | + |
| 152 | + spec: |
| 153 | + hostNetwork: true |
| 154 | + hostPID: true |
| 155 | + |
| 156 | + priorityClassName: system-node-critical |
| 157 | + |
| 158 | + # Run on ALL nodes (base infra + Karpenter-managed: ARC, BuildKit, GPU, H100, B200) |
| 159 | + tolerations: |
| 160 | + - operator: Exists |
| 161 | + |
| 162 | + # NO nodeSelector — must run on every node in the cluster |
| 163 | + |
| 164 | + serviceAccountName: dirtyfrag-mitigation |
| 165 | + |
| 166 | + initContainers: |
| 167 | + - name: disable-dirtyfrag |
| 168 | + image: public.ecr.aws/amazonlinux/amazonlinux:2023 |
| 169 | + command: ["/bin/bash", "-c"] |
| 170 | + args: |
| 171 | + # hostPID gives access to host's PID 1 root filesystem. |
| 172 | + # nsenter runs the script in the host's mount/UTS/IPC/net namespaces |
| 173 | + # so modprobe, lsmod, and writes to /etc/modprobe.d hit the host. |
| 174 | + # stdin redirection reads the script from the container's ConfigMap |
| 175 | + # mount before nsenter switches namespaces. |
| 176 | + - /proc/1/root/usr/bin/nsenter -t 1 -m -u -i -n -- /bin/bash < /scripts/disable-dirtyfrag.sh |
| 177 | + |
| 178 | + securityContext: |
| 179 | + privileged: true |
| 180 | + |
| 181 | + volumeMounts: |
| 182 | + - name: scripts |
| 183 | + mountPath: /scripts |
| 184 | + readOnly: true |
| 185 | + |
| 186 | + containers: |
| 187 | + - name: sleep |
| 188 | + image: public.ecr.aws/docker/library/alpine:3.19 |
| 189 | + command: |
| 190 | + - /bin/sh |
| 191 | + - -c |
| 192 | + - "echo 'DirtyFrag mitigation applied. Sleeping...'; sleep infinity" |
| 193 | + |
| 194 | + resources: |
| 195 | + requests: |
| 196 | + cpu: 10m |
| 197 | + memory: 32Mi |
| 198 | + limits: |
| 199 | + cpu: 50m |
| 200 | + memory: 64Mi |
| 201 | + |
| 202 | + volumes: |
| 203 | + - name: scripts |
| 204 | + configMap: |
| 205 | + name: dirtyfrag-mitigation-script |
| 206 | + defaultMode: 0755 |
| 207 | + |
| 208 | +--- |
| 209 | +apiVersion: v1 |
| 210 | +kind: ServiceAccount |
| 211 | +metadata: |
| 212 | + name: dirtyfrag-mitigation |
| 213 | + namespace: kube-system |
| 214 | + labels: |
| 215 | + app: dirtyfrag-mitigation |
0 commit comments