From f5c3d77087e6bf657184d4d4946c8dcd5834191a Mon Sep 17 00:00:00 2001 From: WenChao Zhang Date: Wed, 8 Jul 2026 15:51:25 +0000 Subject: [PATCH] Restore IPsec ESP modules Dirty Frag has been fixed upstream: - xfrm-ESP Page-Cache Write (CVE-2026-43284) was patched in mainline f4c50a4034e6 - RxRPC Page-Cache Write (CVE-2026-43500) was patched in mainline aa54b1d27fe0 Reference: https://github.com/V4bel/dirtyfrag Fixes #673 This reverts commit 486cf7bc9feeccaba67c9a764e53236e3303bc2c. --- .../usr/lib/modprobe.d/99-kde-linux-security.conf | 15 +++------------ mkosi.finalize.d/40-core.sh.chroot | 9 ++------- 2 files changed, 5 insertions(+), 19 deletions(-) diff --git a/mkosi.extra/usr/lib/modprobe.d/99-kde-linux-security.conf b/mkosi.extra/usr/lib/modprobe.d/99-kde-linux-security.conf index 30bf27d..2befbcc 100644 --- a/mkosi.extra/usr/lib/modprobe.d/99-kde-linux-security.conf +++ b/mkosi.extra/usr/lib/modprobe.d/99-kde-linux-security.conf @@ -23,17 +23,8 @@ install algif_rng /usr/bin/false blacklist algif_skcipher install algif_skcipher /usr/bin/false -# esp4, esp6, and rxrpc are only used for IPsec-in-IPv4, IPsec-in-IPv6, and the -# AF_RXRPC socket protocol (used by AFS/kAFS clients) respectively as none of which -# are used on KDE Linux. Disabling them mitigates the dirtyfrag vulnerability. -# See also: -# - https://github.com/V4bel/dirtyfrag - -blacklist esp4 -install esp4 /usr/bin/false - -blacklist esp6 -install esp6 /usr/bin/false - +# rxrpc is only used for the AF_RXRPC socket protocol by AFS/kAFS clients, +# which are not used on KDE Linux. Disable it to reduce our attack +# surface. blacklist rxrpc install rxrpc /usr/bin/false diff --git a/mkosi.finalize.d/40-core.sh.chroot b/mkosi.finalize.d/40-core.sh.chroot index cb92c2f..1f820ad 100755 --- a/mkosi.finalize.d/40-core.sh.chroot +++ b/mkosi.finalize.d/40-core.sh.chroot @@ -170,22 +170,17 @@ fi # Delete af_alg et al. kernel modules; they're dangerous and unused by anything # relevant except for iwd and non-default cryptsetup algorithms, neither of which -# are supported on KDE Linux. Also delete esp4, esp6, and rxrpc which are -# exploitable via the dirtyfrag vulnerability and are only used for IPsec-in-IPv4, IPsec-in-IPv6, and the -# AF_RXRPC socket protocol (used by AFS/kAFS clients) respectively as none of which -# are used on KDE Linux. +# are used on KDE Linux. Also delete rxrpc, which is only used for the AF_RXRPC +# socket protocol by AFS/kAFS clients, which are not used on KDE Linux. # See also: # - https://www.secwest.net/copyfail-mitigation # - https://news.ycombinator.com/item?id=47956312 -# - https://github.com/V4bel/dirtyfrag rm -rf \ /usr/lib/modules/*/kernel/crypto/af_alg.ko.zst \ /usr/lib/modules/*/kernel/crypto/algif_aead.ko.zst \ /usr/lib/modules/*/kernel/crypto/algif_hash.ko.zst \ /usr/lib/modules/*/kernel/crypto/algif_rng.ko.zst \ /usr/lib/modules/*/kernel/crypto/algif_skcipher.ko.zst \ - /usr/lib/modules/*/kernel/net/ipv4/esp4.ko.zst \ - /usr/lib/modules/*/kernel/net/ipv6/esp6.ko.zst \ /usr/lib/modules/*/kernel/net/rxrpc/rxrpc.ko.zst # Clean up final remnants of the build process