Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP | Wiz Blog

What it is

"Fragnesia" — a new variant in the DirtyFrag family of Linux kernel local privilege escalation vulnerabilities, in the XFRM ESP-in-TCP (espintcp) subsystem. Discovered by Hyunwoo Kim (the DirtyFrag researcher) as an unintended side effect of a patch for the original DirtyFrag. It gives an unprivileged local attacker a deterministic page-cache corruption primitive leading to root. No CVE, kernel version boundary, or specific patch identifier is stated on the page.

How it works

The core detail the summary omits is an ordering condition: the exploit splices file-backed pages into a TCP receive queue before the socket transitions into espintcp ULP mode. Once ESP processing is enabled, the kernel decrypts the already-queued data in-place. Because of improper handling of shared page fragments during skb coalescing, this in-place AES-GCM decryption corrupts the underlying read-only page-cache pages — controlled single-byte writes rather than arbitrary overwrite.

flowchart LR
    A[Splice file-backed pages<br/>into TCP recv queue] --> B{Socket enters<br/>espintcp ULP mode}
    B -->|pages already queued| C[In-place AES-GCM decrypt]
    C --> D[Single-byte corruption<br/>of read-only cache page]
    D --> E[Overwrite /usr/bin/su<br/>in cache → root shell]

The attacker obtains CAP_NET_ADMIN inside an isolated user+network namespace, installs a crafted ESP security association via NETLINK_XFRM, then repeatedly triggers the writes. The demonstration overwrote the first bytes of /usr/bin/su with a small ELF payload calling setresuid(0,0,0) and executing /bin/sh. The change lives only in page-cache memory; the on-disk binary is untouched.

Preconditions / Affected

• Linux kernels with the XFRM ESP-in-TCP subsystem present/enabled.
• Unprivileged local access sufficient to create user and network namespaces (used to gain CAP_NET_ADMIN in-namespace). Unlike DirtyFrag, no host-level privileges are required.

What to do

• Apply vendor kernel patches for the underlying XFRM ESP-in-TCP flaw as they become available.
• Until patched, disable the vulnerable modules for both Fragnesia and DirtyFrag if not required. (The page references specific module-disable commands, but they were not present in the fetched text — confirm the exact modules on the source page before acting.)

Caveats

AppArmor restrictions on unprivileged user namespaces — the Ubuntu default — are only a partial mitigation; the page states exploitation would require additional bypasses rather than being blocked outright.