Beta Branch add cmsec CVE-2026-43284 + CVE-2026-43500 dirtyfrag detection in 140.00beta01

add cmsec CVE-2026-43284 + CVE-2026-43500 dirtyfrag detection in 140.00beta01

Two new cmsec check scripts ship the Dirty Frag (CVE-2026-43284 xfrm-ESP +
CVE-2026-43500 RxRPC) verdict line in the dmotd SSH banner across CentOS 7,
RHEL 7/8/9/10, AlmaLinux 8/9/10 (incl. Kitten), Rocky 8/9/10, Oracle Linux
8/9/10 RHCK, and CloudLinux 7/7h/8/9/10. Discovery is automatic via the
existing check-*.sh filename glob — no dispatcher or dmotd.sh changes
required.

CVE-2026-43284 (xfrm-ESP) verdict logic mirrors the 31431 template's
case-statement on \${os_id}:\${os_version} but with these distinctions:
- centos:7* + rhel:7* + cloudlinux:7 (non-h) → not_affected; the in-place
ESP decrypt fast path was introduced upstream in commit cac2661c53f3
(2017-01-17), postdating the EL7 3.10 codebase. Confidence medium pending
RHSB-2026-003.
- cloudlinux:7* with kernel_track=cloudlinux-7h → AFFECTED; CL7h hybrid
kernel is based on EL8 (osdetect.sh:46 sets the track via *.lve.el7h*).
- AL8/Rocky 8/RHEL 8 baseline kernel-4.18.0-553.123.2.el8_10
- AL9/Rocky 9/RHEL 9 baseline kernel-5.14.0-611.54.3.el9_7
- AL10/Rocky 10/RHEL 10/Kitten 10 baseline kernel-6.12.0-124.55.3.el10_1
- CloudLinux 10: ESP-only floor 6.12.0-124.55.2.el10_1; raised to AL10
6.12.0-124.55.3.el10_1 floor when rxrpc is present (CL .55.2 lacks the
combined RxRPC fix as of 2026-05-08).
- Oracle / CloudLinux / RHEL NVRs flagged pending_vendor_nvr=true; AlmaLinux
baseline used as conservative floor until vendors publish.

CVE-2026-43500 (RxRPC) is a slim variant: EL7 / EL8 / Linode / containers
short-circuit to not_affected (rxrpc module never built/shipped). EL9/10
(incl. RHEL 9/10) fall through to detect_rxrpc_presence(): /sys/module/
rxrpc, modules.builtin, /lib/modules/*/{kernel,extra,partner}/net/rxrpc/
rxrpc.ko*, modinfo, and rpm -q kernel-modules-partner-\$(uname -r) for
AlmaLinux. When rxrpc is absent the verdict is not_affected; when present
it's compared against the same vendor baseline used for 43284. Vendors
other than AlmaLinux mark rxrpc_package_path_verified=false in JSON until
packaging confirmed.

The modprobe-blacklist stopgap (install esp4 /bin/false) is suppressed on
hosts that appear to use IPsec — detected via ip xfrm policy/state list,
strongswan/libreswan/ipsec service state, /etc/ipsec.{conf,d/*.conf,secrets},
/etc/swanctl/**/*.conf, /etc/strongswan{.conf,.d}, NetworkManager VPN
connections (nmcli type=vpn — NOT type=wireguard, since WireGuard is
unaffected by xfrm-ESP), and /etc/NetworkManager/system-connections/
*.nmconnection profiles with vpn-type=libreswan|strongswan|ipsec. Applying
the workaround on those hosts breaks IPsec data-path traffic; the long-form
output prints a hard red warning and recommends kernel update only.

The detect_modprobe_blacklist() function intentionally tracks esp4/esp6
only — a file blacklisting only rxrpc does NOT mark this CVE's mitigation
as active, since rxrpc blacklist mitigates only CVE-2026-43500 (its own
check owns that detection).

Cache-key extension in lib/cache.sh appends a 7th tuple field to
cmsec_cache_state_key — a SHA-256 over /etc/modprobe.d, /usr/lib/modprobe.d,
and /run/modprobe.d files containing esp4|esp6|rxrpc blacklist directives,
folded with /proc/modules state for the same modules. This invalidates the
cached verdict the moment the user toggles /etc/modprobe.d/dirtyfrag.conf
or rmmod's the modules. ALL existing /var/cache/centminmod/cmsec/*.cache
entries (incl. cve-2026-31431) invalidate on first run after upgrade —
by design.

---

Changes:
- tools/cmm-security/checks/check-cve-2026-43284.sh (NEW, ~860 lines)
detection-only; no probe script. Flag matrix: --json --quiet --debug
--log-file --help. Emits final_status \\u2208 {patched, not_affected,
vulnerable, indeterminate} with snake_case JSON keys (esp4_state,
esp6_state, rxrpc_state, modprobe_blacklist_path, ipsec_host_detected,
ipsec_detection_reasons, pending_vendor_nvr, vendor_baseline,
comparison_result, livepatch_*).
- tools/cmm-security/checks/check-cve-2026-43500.sh (NEW, ~470 lines)
same flag matrix; slim verdict path gated on rxrpc presence detection.
- tools/cmm-security/lib/cache.sh — cmsec_cache_state_key digest tuple
extended from 6 fields (kernel|os|cmdline|livepatch|script|baseline) to
7 fields with the trailing modprobe_dirtyfrag_digest. printf goes from
6 to 7 %s.
- Cross-AI-reviewed (Codex GPT-5.5 + code-searcher); P0 fixes folded in:
added stock RHEL 7/8/9/10 routing in 43284 and RHEL 9/10 routing in
43500, removed wireguard from NetworkManager IPsec heuristic (WireGuard
does NOT use xfrm-ESP), narrowed detect_modprobe_blacklist to esp4/esp6
only (rxrpc-only blacklist is irrelevant to ESP CVE), deduped
strongswan-installed marker.
- Branch parity with 141.00beta01 (commit 70d5bb5f) and 132.00stable;
tools/cmm-security/ remains byte-identical across all three branches.

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01