News for hackers. Stuff that matters.
Re:Dirtyfrag: Universal Linux LPE by eqvinox on Thursday May 07, 2026 @04:27PM (#48054478)
No, unless I'm misreading it it's the *same* root cause: high 32 bits of Extended ESN in IPsec == authencesn module/cipher mode.

The wrong thing got fixed for copy.fail, because people jumped to blame AF_ALG.

[ed.: yes it's the same authencesn issue. https://github.com/V4bel/dirtyfrag/blob/892d9a31d391b7f0fccb... it doesn't say authencesn in the code, only in a comment, but nonetheless, same issue.]

[ed.2: the RxRPC issue is separate, this is about the ESP one]

Re:Dirtyfrag: Universal Linux LPE by firer on Thursday May 07, 2026 @04:39PM (#48054647)
There are two vulnerabilities here.

The RxRPC one is definitely a different root cause (although caused by a very similar mistake).

For the ESP one it's a bit harder to tell. I don't think the wrong thing was fixed, just that there was a very similar bug in almost the same spot. Could be wrong about that though.

Re:Dirtyfrag: Universal Linux LPE by eqvinox on Thursday May 07, 2026 @04:44PM (#48054688)
(you probably wrote this while I was editing my post.)

It's absolutely the same issue in authencesn/ESP. There's another one in RxRPC that is AIUI completely unrelated.

Re:Dirtyfrag: Universal Linux LPE by pepa65 on Friday May 08, 2026 @10:54PM (#48071348)
But if dirtyfrag is mitigated, copyfail is still active...