What is dirtyfail?

DIRTYFAIL is a security research tool that detects and demonstrates a family of Linux kernel vulnerabilities related to "page-cache writes." These vulnerabilities allow an unprivileged user to modify the system's in-memory copy of a file they normally can only read, like the password file. The tool checks if a Linux server is vulnerable to these specific flaws and can execute a proof-of-concept that gives the user root (full administrator) access on an unpatched system. At a high level, the bug tricks the Linux kernel into corrupting its own temporary memory. When a system reads a file, it stores a copy in RAM for quick access. The vulnerabilities exploit a flaw in how the kernel handles certain network and crypto operations, forcing it to overwrite small parts of that cached file. By targeting the system's user database, an attacker can change their own user ID to zero, the system's designation for root, tricking the server into granting them total control without ever touching the actual file on the hard drive. This tool is built for security researchers, penetration testers, and system administrators who need to know if their infrastructure is at risk. For example, a red-team auditor could use it to safely prove that a client's server can be fully compromised by a low-level user. It includes a "scan" mode that safely checks the system's defenses without causing harm, and an "exploit" mode that drops the user into a root shell on a vulnerable machine. Because the tool only modifies the system's RAM and not the disk, the changes disappear on reboot or when the system clears its cache. A notable aspect of this project is its thorough testing and defensive focus. The documentation includes a detailed matrix of operating systems, showing exactly which versions are vulnerable and which are protected by security modules like AppArmor. It also provides companion scripts for defenders to set up audit alerts and test container escapes. The tool requires explicit, typed confirmation before running any destructive exploit, reinforcing its strictly authorized research intent.