An unprivileged local user can corrupt arbitrary readable files in the page cache by exploiting a u32 integer wraparound in tcf_pedit_act() that causes skb_ensure_writable() to protect fewer bytes than pedit subsequently writes. The write lands directly on page-cache-backed skb frag pages that entered the packet via splice().
Unlike other page-cache exploits in this class (Dirty Frag, Fragnesia, skb_shift, GRO) which rely on ESP/AES-GCM crypto for the write primitive, Dirty Pedit uses TC's skb_store_bits() for a direct, fully-controlled 4-byte write per pedit key — no crypto, no IV tables, no key schedules.
An unprivileged local user can corrupt arbitrary readable files in the page cache by exploiting a u32 integer wraparound in tcf_pedit_act() that causes skb_ensure_writable() to protect fewer bytes than pedit subsequently writes. The write lands directly on page-cache-backed skb frag pages that entered the packet via splice().
Unlike other page-cache exploits in this class (Dirty Frag, Fragnesia, skb_shift, GRO) which rely on ESP/AES-GCM crypto for the write primitive, Dirty Pedit uses TC's skb_store_bits() for a direct, fully-controlled 4-byte write per pedit key — no crypto, no IV tables, no key schedules.