Skip to content

README.md

Latest commit

 

History

History
36 lines (25 loc) · 828 Bytes

README.md

File metadata and controls

36 lines (25 loc) · 828 Bytes
Raw

Dirty Merge PoC

Linux kernel local privilege escalation via skb_gro_receive() SKBFL_SHARED_FRAG non-propagation (GRO layer flag stripping).

Build

gcc -O2 -Wall -Wextra -static -o dirty_merge gro_fragnesia.c

Requirements

  • Linux kernel with CONFIG_XFRM, CONFIG_INET_ESPINTCP, CONFIG_USER_NS
  • User namespaces enabled (Ubuntu: sysctl -w kernel.apparmor_restrict_unprivileged_userns=0)
  • ip (iproute2) and ethtool in PATH
  • veth kernel module loaded

Run

# As unprivileged user:
./dirty_merge
# Corrupts /usr/bin/su page cache with shell ELF, then execve's it -> root shell

Restore

# As root:
echo 3 > /proc/sys/vm/drop_caches

Tested on

  • Ubuntu 24.04 LTS, kernel 6.8.0-49-generic
  • Also affects: Linux 7.1-rc3 and all kernels with unpatched skb_gro_receive()