Overview

EVS has been informed of a recently disclosed Linux kernel vulnerability known as “Dirty Frag”, a local privilege escalation vulnerability affecting multiple Linux kernel versions. Public proof-of-concept (PoC) exploit code is already available. 

At this stage, EVS products running on Rocky Linux may be impacted depending on the enabled kernel modules and system configuration. Products not using Rocky Linux are not affected. 

The vulnerability could allow a local authenticated attacker to escalate privileges to root under specific conditions. 

Affected products

Only EVS products deployed on Rocky Linux environments are potentially impacted. 

Current investigations are ongoing to determine the exact exposure and impacted product versions.

Technical Details

The vulnerability affects specific Linux kernel networking modules, notably: 

  • esp4 

  • esp6 

  • rxrpc 

Public exploit code demonstrates that successful exploitation may lead to local privilege escalation (LPE) and full root access on vulnerable systems. According to publicly available information, the issue is related to improper handling of fragmented memory pages in the Linux kernel networking stack. 

The vulnerability currently has no official upstream patch available at the time of publication. Public disclosures indicate that the embargo was broken before coordinated fixes could be released. 

Mitigation

As no official patch is currently available, EVS recommends applying temporary mitigations where operationally possible. 

The published workaround consists of disabling the following kernel modules: 

  • esp4 

  • esp6

  • rxrpc 

Example mitigation command published by the security community: 

sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true" 

Please note that this mitigation may impact environments using: 

  • IPsec 

  • RxRPC / AFS services

EVS Recommendations

EVS recommends customers to: 

  • Restrict local shell access to trusted administrators only 

  • Monitor systems for suspicious privilege escalation activity 

  • Apply the proposed mitigations when compatible with operational constraints 

  • Follow future EVS communications regarding official patches and validated remediation actions

Status

EVS Product Security teams are actively monitoring the situation and evaluating impacted products. 

This advisory will be updated as additional information, patches or validated mitigations become available.

References

https://github.com/V4bel/dirtyfrag

Products under investigation

Windows Products 

ProductVersionStatusPatched Version
CerebrumAllNot vulnerable 
IPDirectorAllNot vulnerable 
IPWeb API ServicesAllNot vulnerable 
XPloreAllNot vulnerable 
XedioAllNot vulnerable 
C-CastAllNot vulnerable 
MADAllNot vulnerable 
XTAccessAllNot vulnerable

 

XViewerAllNot vulnerable

 

VIA XSquareAll Not vulnerable 
XFile3AllNot vulnerable

 

XNetMonitor / XNetWebMonitorAllNot vulnerable

 

Move I/O / Move UPAllNot vulnerable 
C-NEXTAllNot vulnerable 
Ingest FunnelAllNot vulnerable 
MultiReviewAllNot vulnerable 
Truck ManagerAllNot vulnerable 

 

Linux Products

ProductVersionStatusPatched version
NeuronAllUnder investigation 
SynapseAllUnder investigation 
VIA MAPAllUnder investigation 
IPWeb Streaming ServerAllUnder investigation 
MediaHubAllUnder investigation 
XT / MulticamAllUnder investigation 
XHub-VIAAllUnder investigation 
XS-NEOAllUnder investigation 
XR-NEOAllUnder investigation 
XeebraAllUnder investigation 
LSGAllUnder investigation 
LSM-VIAAllUnder investigation 
XtraMotionAllUnder investigation 
DYVI Under investigation 
Ingest Funnel Under investigation