# v4bel/dirtyfrag architecture

> Architecture diagram of the GitHub repository v4bel/dirtyfrag, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/v4bel/dirtyfrag
- Repository: https://github.com/v4bel/dirtyfrag

## Overview

Dirty Frag is a single-file Linux local-privilege-escalation proof of concept. Its documented workflow chains the xfrm-ESP and RxRPC page-cache-write vulnerabilities; the sampled C excerpt also shows target-file setup and verification, RxRPC setup, and a later `su` shell stage. The README documents mitigation and affected versions, but this small repository has no separate runtime subsystem for them. Excerpts are partial, so internal exploit sequencing beyond the documented chain is not inferred.

Main entry points: [`exp.c`](https://github.com/v4bel/dirtyfrag/blob/master/exp.c) (Dirty Frag PoC)

## Diagram (Mermaid)

```mermaid
flowchart TD

node_user(("Authorized user"))
node_poc["Dirty Frag PoC<br/>[exp.c]"]
node_esp["xfrm-ESP variant<br/>[exp.c]"]
node_rxrpc["RxRPC variant<br/>[exp.c]"]
node_pagecache[("Page cache")]
node_target["Target file"]
node_shell["Root shell"]

node_user -->|"runs"| node_poc
node_poc -->|"chains variant"| node_esp
node_poc -->|"chains variant"| node_rxrpc
node_esp -->|"writes via"| node_pagecache
node_rxrpc -->|"writes via"| node_pagecache
node_poc -->|"maps and verifies"| node_target
node_poc -->|"spawns via su"| node_shell

click node_poc "https://github.com/v4bel/dirtyfrag/blob/master/exp.c"
click node_esp "https://github.com/v4bel/dirtyfrag/blob/master/exp.c"
click node_rxrpc "https://github.com/v4bel/dirtyfrag/blob/master/exp.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_user toneBlue
class node_poc,node_esp,node_rxrpc toneTeal
class node_pagecache toneAmber
class node_target,node_shell toneIndigo
```

## Components

### Other components

- **Authorized user**
- [Dirty Frag PoC](https://github.com/v4bel/dirtyfrag/blob/master/exp.c): `exp.c`
- [xfrm-ESP variant](https://github.com/v4bel/dirtyfrag/blob/master/exp.c): `exp.c`
- [RxRPC variant](https://github.com/v4bel/dirtyfrag/blob/master/exp.c): `exp.c`
- **Page cache**
- **Target file**
- **Root shell**

## Connections

- Authorized user → Dirty Frag PoC: runs (evidence: `README.md`)
- Dirty Frag PoC → xfrm-ESP variant: chains variant (evidence: `README.md`)
- Dirty Frag PoC → RxRPC variant: chains variant (evidence: `README.md`)
- xfrm-ESP variant → Page cache: writes via (evidence: `README.md`)
- RxRPC variant → Page cache: writes via (evidence: `README.md`)
- Dirty Frag PoC → Target file: maps and verifies (evidence: `exp.c`)
- Dirty Frag PoC → Root shell: spawns via su (evidence: `exp.c`)