Mitigation for Dirty Frag Linux local privilege escalation vulnerability

Yes another local privilege escalation vulnerability was recently publicly announced – dirtyfrag.io.

Mitigation does not require server reboot, only making sure kernel modules esp4, esp6 and rxrpc are disabled.

: > /etc/modprobe.d/dirtyfrag.conf
echo 'install esp4 /bin/false' >> /etc/modprobe.d/dirtyfrag.conf
echo 'install esp6 /bin/false' >> /etc/modprobe.d/dirtyfrag.conf
echo 'install rxrpc /bin/false' >> /etc/modprobe.d/dirtyfrag.conf
rmmod esp4 esp6 rxrpc 2>/dev/null

Note: The esp4 and esp6 modules are used by IPSEC. If your server is using IPSEC unloading them will break the connections over IPSEC or unload operation will fail. Quick check to make sure modules are unloaded – command lsmod | grep -F -e esp4 -e esp6 -e rxrpc should return no results.