git404hub

what is page-cache-corruption-lpes fr?

rjt-gupta/page-cache-corruption-lpes — explained in plain English

Analysis updated 2026-05-18

2CAudience · researcherComplexity · 5/5Setup · moderate

tl;dr

Three proof-of-concept exploits for the Linux kernel that let a normal user gain root access in seconds by corrupting in-memory file copies, not the files on disk.

vibe map

mindmap
  root((repo))
    What it does
      Three Linux kernel exploits
      Grants root access fast
      Corrupts in-memory page cache
    How it works
      Original files stay unchanged
      Trusted programs run modified code
      Reboot or drop caches to fix
    The three exploits
      Dirty Pedit fastest
      skb_shift networking path
      GRO Flag Loss networking path
    Tech stack
      C language
      gcc compiler
      Standard C library
    Use cases
      Learn kernel security
      Test your kernel patches
      Verify fixes are applied
    Audience
      Security researchers
      Kernel developers
      Defensive engineers

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

what do people make with this?

VIBE 1

Study how page cache corruption exploits work to improve kernel hardening.

VIBE 2

Test whether a Linux system is still vulnerable after applying kernel patches.

VIBE 3

Demonstrate the impact of kernel networking bugs for security training or CTF challenges.

what's the stack?

CgccLinux kernel

how it stacks up fr

rjt-gupta/page-cache-corruption-lpesalisharafiiii/sauron-eyecode-my-spec/ear_witness
Stars222
LanguageCCC
Setup difficultymoderatehardhard
Complexity5/55/54/5
Audienceresearcherdeveloperdeveloper

Figures from each repo's GitHub metadata at analysis time.

how do i run it?

Difficulty · moderate time til it works · 30min

Needs a vulnerable Linux kernel version and an isolated VM or test environment to avoid risking your main system.

No license is specified in the repository, so default copyright restrictions apply and the code should be treated as educational reference material only.

in plain english

This repository contains three working exploits for the Linux kernel that let an ordinary user gain full administrator (root) access in seconds. The author, Rajat Gupta who works in offensive security at Qualcomm, presents these as proof-of-concept code tied to real CVE assignments. The bugs share a family resemblance with famous older exploits called Dirty COW and Dirty Pipe. All three exploits target the kernel's page cache, which is the in-memory copy of files that programs actually read and run. The original file on disk is never modified, so file integrity checkers see nothing wrong. When the system tries to run a trusted program like su, it loads the corrupted version from memory and instead executes the attacker's code with root privileges. The three exploits differ in how they trick the kernel and how they write their payload. Dirty Pedit abuses the network traffic control subsystem through an integer wraparound, writes four bytes per packet, and needs no cryptographic tricks, getting root in under one second. The other two, skb_shift and GRO Flag Loss, both exploit a lost shared-fragment flag in different networking paths, then use ESP decryption to write one byte per packet over roughly ten seconds. The README documents the affected kernel versions, ranging from Linux 3.9 (2013) through 7.1 release candidates in 2026. It states every major distribution was affected by default with no special hardening required. The author reports that all vulnerabilities were responsibly disclosed to kernel maintainers, and patches are merged and backported to stable trees. Each exploit is a single C file compiled with gcc using no dependencies beyond the standard C library. The README includes sample build commands and example output showing an unprivileged user becoming root. The author notes the exploits are published for educational and defensive purposes now that fixes are available, and that rebooting or dropping caches restores the original files. The full README is longer than what was shown.

prompts (copy fr)

prompt 1
I want to understand how the Linux kernel page cache works and how corrupting it can lead to root privilege escalation. Walk me through the concept using this repo's three exploits as examples, assuming I know basic C.
prompt 2
Help me compile and safely test the Dirty Pedit exploit from this repo in an isolated VM running a vulnerable Linux kernel version. Give me the exact steps to avoid affecting my host system.
prompt 3
I'm patching a Linux kernel networking subsystem. How can I use the concepts in this repo's skb_shift and GRO Flag Loss exploits to write regression tests that check whether the shared-fragment flag bug is fixed?
prompt 4
Explain the difference between these three page cache exploits and the older Dirty COW and Dirty Pipe vulnerabilities. What makes the page cache corruption approach here harder to detect with file integrity checkers?

Frequently asked questions

what is page-cache-corruption-lpes fr?

Three proof-of-concept exploits for the Linux kernel that let a normal user gain root access in seconds by corrupting in-memory file copies, not the files on disk.

What language is page-cache-corruption-lpes written in?

Mainly C. The stack also includes C, gcc, Linux kernel.

What license does page-cache-corruption-lpes use?

No license is specified in the repository, so default copyright restrictions apply and the code should be treated as educational reference material only.

How hard is page-cache-corruption-lpes to set up?

Setup difficulty is rated moderate, with roughly 30min to a first successful run.

Who is page-cache-corruption-lpes for?

Mainly researcher.

peek the repo → explain another one

This repo across BitVibe Labs

double-check against the repo, no cap.