After the CopyFail vulnerability gave root access from any user on almost all distributions last week, this week we’ve got DirtyFrag . This chains the vulnerability in CopyFail (xfrm-ESP) and a new vulnerability in a RPC function which allows similar overwriting of the page cache. Both vulnerabilities manipulate the Linux page cache where data from disk is stored for rapid access. The kernel will always prefer the cached version of a file, which means that anything that is able to manipulate the contents of the cache can effectively replace the contents of the file. Both of the vulnerabilities leverage a similar mechanism – picking a binary which is flagged to run as root, such as  su , and replacing the contents that would prompt for the users password with a launcher to immediately run a shell.…