cross-posted from: https://lemmy.world/post/46584454
Local Privilege Escalation "Dirty Frag" made public
- https://www.openwall.com/lists/oss-security/2026/05/07/8
- https://thehackernews.com/2026/05/linux-kernel-dirty-frag-lpe-exploit.html
- https://safecomputing.umich.edu/security-alerts/linux-kernel-vulnerability-%E2%80%9Cdirty-frag%E2%80%9D
- https://www.bleepingcomputer.com/news/security/new-linux-dirty-frag-zero-day-with-poc-exploit-gives-root-privileges/
5 Comments
irmadlad@lemmy.world · 13 pts · 102d
RFC: As I understand it this exploit requires local access and cannot be deployed remotely. Is this a correct analysis?
eager_eagle@lemmy.world · 12 pts · 102d
right, but remote code execution comes in many different ways. Having a machine vulnerable to this kind of privilege escalation is a really bad thing.
irmadlad@lemmy.world · 5 pts · 102d
Certainly. I don't discount that any exploit is 'really bad'. I like my OS of choice to be as free of exploits as it can possibly be. However, some of the material I was reading involved areas of Linux that I have little if any knowledge of value with, so I thought I'd as the question.
ShortN0te@lemmy.ml · 0 pts · 102d
Mondez@lemdro.id · 9 pts · 102d
It's a LOCAL privilege escalation vulnerability. You need sufficient access to be able to execute arbitrary code locally on the machine. You would need a remote code execution vulnerability in an exposed service (VPN, web server, game server and so on) before an attacker could chain to this to get remote root on your system.
Decronym@lemmy.decronym.xyz · 1 pts · 102d
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
[Thread #279 for this comm, first seen 8th May 2026, 23:40] [FAQ] [Full list] [Contact] [Source code]