Post B650cYlRDgTHoqKNpg by yuka@fedi.yuka.dev
 (DIR) More posts by yuka@fedi.yuka.dev
 (DIR) Post #B63yQmQKDLQZdqkPzc by leona@social.infinitespace.dev
       1 likes, 4 repeats
       
       and here we go for the next ride https://github.com/V4bel/dirtyfrag – kinda CopyFail V2
       
 (DIR) Post #B641zGikNOddJaV9Zw by erincandescent@erincandescent.net
       1 likes, 0 repeats
       
       Because the responsible disclosure schedule and the embargo have been broken, no patch exists for any distribution. Use the following command to remove the modules in which the vulnerabilities occur.sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"but but but… I actually have ipsec tunnels :akko_cry:RE: https://social.infinitespace.dev/@leona/statuses/01KR1Y7S7SYJ1E4VTMWF6J6NTG
       
 (DIR) Post #B64249ttA4aVbt2pVo by lanodan@queer.hacktivis.me
       0 likes, 0 repeats
       
       @erincandescent Patch is available here: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4
       
 (DIR) Post #B64vE7RedlGwMybIky by adalanerd@eldritch.cafe
       0 likes, 0 repeats
       
       @leona So apparently another one, pretty similar, was also published in the same time. Same shit, no CVE, no responsible disclosure.Here's the patch I applied to my servers, forking the one given by V4bel to also disable the modules named by @domi:sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\ninstall xfrm_user /bin/false\ninstall xfrm_algo /bin/false\n' > /etc/modprobe.d/dirtyfragandco.conf; rmmod esp4 esp6 rxrpc xfrm_user xfrm_algo 2>/dev/null; true"#copyfail #dirtyfrag #electricBoogaloo #sysadmin
       
 (DIR) Post #B64vE7elqzlR1ejmCW by leona@social.infinitespace.dev
       0 likes, 0 repeats
       
       @adalanerd @domi no, that’s the same one. That’s the one which broke the embargo. The author says that themselves: https://www.openwall.com/lists/oss-security/2026/05/07/12
       
 (DIR) Post #B64vE7rB6rgle8XgXY by adalanerd@eldritch.cafe
       0 likes, 0 repeats
       
       @leona@domi ok! Thanks for the correction! So if I get it right the xfrm modules are not necessary to disable then?
       
 (DIR) Post #B64vE80OYb3s6ir2uG by domi@donotsta.re
       0 likes, 0 repeats
       
       @adalanerd @leona each of them are a part of the exploit chain. If you’re feeling alright with just patching the currently-known entrypoint - sure! But people will find more broken modules, and then they may use xfrm_* in their own chain. Do you want to risk it?I’ve disabled kernel module autoload entirely: sysctl kernel.modules_disabled=1, at least on systems where people have direct shell access to.
       
 (DIR) Post #B650cYlRDgTHoqKNpg by yuka@fedi.yuka.dev
       0 likes, 0 repeats
       
       @domi @adalanerd @leona as I understood it it’s not necessarily a chain but just two vulnerabilities which cover most systems together
       
 (DIR) Post #B650cZ0KKKNgZ1IH2W by yuka@fedi.yuka.dev
       1 likes, 0 repeats
       
       @adalanerd @leona@domi sorry I misread your post, you meant an attack would be a chain of an exploit to obtain unprivileged code execution, and then one of the two given vulns could escalate that
       
 (DIR) Post #B659CfKt3wuMG8dWFM by airtower@woem.men
       0 likes, 0 repeats
       
       @adalanerd@eldritch.cafe @domi@donotsta.re @leona@social.infinitespace.dev Well, assuming you run 7.0.5 (published this morning) or a build right from Git master branch. Looking at the history v7.1-rc2 doesn't include the patch yet. https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.0.5
       
 (DIR) Post #B659CfbC5Jx54iGXfE by domi@donotsta.re
       0 likes, 0 repeats
       
       @airtower @adalanerd @leona don’t fog up the well, nobody’s running 7.0.5 yet. better mitigate than not.
       
 (DIR) Post #B65Ha5Q13M41RmiLHE by Bubu@chaos.social
       0 likes, 0 repeats
       
       @domi @adalanerd @leona @airtower It's starting to make it into distros now (you can i.e. install it from arch's core-testing)
       
 (DIR) Post #B65Ha5opZ5uggkK9xI by domi@donotsta.re
       0 likes, 0 repeats
       
       @Bubu @adalanerd @leona @airtower arch is always the bleeding edge, i don’t really get your argument. hotfix first, then ask questions