Dirty Frag – Important Linux Kernel Security Notice

We have recently been made aware of a newly disclosed Linux kernel root exploit known as DirtyFrag (CVE pending).

At the time of writing, this appears to affect all Linux systems broadly. The vulnerability was disclosed earlier than originally planned, which means official kernel patches may not yet be available from some operating system vendors.

QuickHost Managed Customers

QuickHost has already applied the recommended mitigation to affected managed customer servers under our care.

No further action is required from managed customers unless we contact you directly.

Unmanaged Servers and Self-Managed Customers

If you manage your own Linux server, we strongly recommend applying the mitigation immediately.

The currently suggested mitigation is to disable the affected kernel modules:

To revert after a patched kernel is installed:

Restore on-disk binaries after mitigation

The exploit can modify legitimate system binaries in page-cache as part of gaining root, so applying the mitigation alone is not enough on systems that may have been targeted before it was in place. After mitigating, drop page-cache:

After applying the mitigation, we recommend rebooting the server where possible.

Important Compatibility Note

This mitigation may break services that rely on:

• IPsec
• AFS / RxRPC distributed file system functionality

Most standard web hosting, VPS, database, email, and application servers do not use these technologies. If you are not familiar with them, it is unlikely that your server depends on them.

Further Information

The public proof of concept and mitigation details are available here:

https://github.com/V4bel/dirtyfrag/tree/master

We will continue to monitor vendor updates and apply official kernel patches to managed systems as they become available.