Уведомление об уязвимости Dirty Frag CVE-2026-43284

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cve-2026-43284-mitigation
  namespace: kube-system
  labels:
    app: cve-2026-43284-mitigation
    security: security-mitigation
spec:
  selector:
    matchLabels:
      name: cve-2026-43284-mitigation
  template:
    metadata:
      labels:
        name: cve-2026-43284-mitigation
    spec:
      hostPID: true
      hostNetwork: true
      initContainers:
      - name: apply-mitigation
        image: emk8s.cr.cloud.ru/ubuntu:22.04
        securityContext:
          privileged: true
        volumeMounts:
        - name: host-root
          mountPath: /host
        command: ["/bin/bash", "-c"]
        args:
        - |
          set -euo pipefail

          echo "--- Step 1: Blacklisting modules ---"
          printf "install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n" > /host/etc/modprobe.d/dirtyfrag.conf
          echo "✓ Created /etc/modprobe.d/dirtyfrag.conf"

          echo "--- Step 2: Unloading modules if active ---"
          for MODULE in esp4 esp6 rxrpc; do
            if chroot /host lsmod | grep -q "^$MODULE"; then
              echo "Module $MODULE is loaded. Unloading..."
              chroot /host rmmod $MODULE 2>/dev/null || echo "⚠ Failed to unload $MODULE (it might be busy)"
            else
              echo "✓ Module $MODULE is not loaded"
            fi
          done

          echo "--- Step 3: Dropping memory caches ---"
          sync
          echo 3 > /host/proc/sys/vm/drop_caches
          echo "✓ Memory caches dropped"
      containers:
      - name: monitoring-agent
        image: emk8s.cr.cloud.ru/ubuntu:22.04
        securityContext:
          privileged: true
        resources:
          requests:
            cpu: 10m
            memory: 16Mi
          limits:
            memory: 32Mi
        command: ["/bin/bash", "-c"]
        args:
        - |
          while true; do
            for MODULE in esp4 esp6 rxrpc; do
              if grep -q "^$MODULE " /proc/modules; then
                echo "$(date): ⚠️ ALERT! Module $MODULE LOADED!"
                chroot /host modprobe -r $MODULE || echo "✗ Cannot unload $MODULE live."
              fi
            done
            sleep 3600
          done
      volumes:
      - name: host-root
        hostPath:
          path: /
          type: Directory