{"id":170701,"date":"2026-05-15T12:24:29","date_gmt":"2026-05-15T10:24:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha"},"modified":"2026-05-15T12:24:29","modified_gmt":"2026-05-15T10:24:29","slug":"fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha","title":{"rendered":"Fragnesia \u2014 zranitelnost v j\u00e1dru Linux, umo\u017e\u0148uj\u00edc\u00ed z\u00edskat root prost\u0159ednictv\u00edm zm\u011bny str\u00e1nkovac\u00ed cache","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ve linuxov\u00e9m j\u00e1d\u0159e byla zji\u0161t\u011bna \u010dtvrt\u00e1 zranitelnost za posledn\u00ed dva t\u00fddny (CVE-2026-46300), kter\u00e1 umo\u017e\u0148uje neopr\u00e1vn\u011bn\u00e9mu u\u017eivateli z\u00edskat opr\u00e1vn\u011bn\u00ed root p\u0159eps\u00e1n\u00edm dat ve str\u00e1nkov\u00e9m cache. Zranitelnosti bylo p\u0159id\u011bleno k\u00f3dov\u00e9 jm\u00e9no Fragnesia nebo Copy Fail 3.0. Podstata zranitelnosti je podobn\u00e1 d\u0159\u00edve zve\u0159ejn\u011bn\u00fdm zranitelnostem Copy Fail a Dirty Frag. Jako v p\u0159\u00edpad\u011b Dirty Frag, i nov\u00e1 zranitelnost se nach\u00e1z\u00ed v podsystemu xfrm-ESP, ale je vyvol\u00e1na jinou chybou a vy\u017eaduje samostatn\u00e9 opraven\u00ed. Je k dispozici funk\u010dn\u00ed exploit. <\/p>\n

Zranitelnost se projevuje v j\u00e1drech Linuxu vydan\u00fdch po 5. kv\u011btnu, kv\u016fli n\u00e1hodn\u00e9mu aktivov\u00e1n\u00ed opravou zranitelnosti Dirty Frag. Pro odstran\u011bn\u00ed zranitelnosti Fragnesia bylo navr\u017eeno opraven\u00ed pro j\u00e1dro Linux. Anal\u00fdza tohoto opraven\u00ed uk\u00e1zala, \u017ee je nedostate\u010dn\u00e9, a proto byl p\u0159ipravena druh\u00e1 verze patche. <\/p>\n

Zranitelnost se nach\u00e1z\u00ed v podsystemu xfrm v implementaci mechanismu enkapsulace protokolu ESP (Encapsulating Security Payload) v TCP (ESP-in-TCP, RFC 8229), kter\u00fd se pou\u017e\u00edv\u00e1 pro tunelov\u00e1n\u00ed provozu IPsec p\u0159es TCP. Aby se zabr\u00e1nilo nadm\u011brn\u00e9mu vyrovn\u00e1v\u00e1n\u00ed operac\u00ed s pou\u017eit\u00edm algoritmu AES-GCM, prov\u00e1d\u011bly se na m\u00edst\u011b prost\u0159ednictv\u00edm prov\u00e1d\u011bn\u00ed operace XOR na datech ve str\u00e1nkov\u00e9m cache. V d\u016fsledku logick\u00e9 chyby vznikly podm\u00ednky, kter\u00e9 umo\u017enily p\u0159epsat 1 byt ve str\u00e1nkov\u00e9m cache na vybran\u00e9m posunu. Opakov\u00e1n\u00edm operac\u00ed je mo\u017en\u00e9 byte-by-byte m\u011bnit obsah jak\u00e9hokoli souboru ve str\u00e1nkov\u00e9m cache. <\/p>\n

V\u0161echny operace \u010dten\u00ed ze soubor\u016f prim\u00e1rn\u011b poskytuj\u00ed obsah ze str\u00e1nkov\u00e9ho cache. V p\u0159\u00edpad\u011b zm\u011bny dat ve str\u00e1nkov\u00e9m cache operace \u010dten\u00ed ze souboru vr\u00e1t\u00ed m\u00edsto skute\u010dn\u011b ulo\u017een\u00fdch informac\u00ed na \u00falo\u017ei\u0161ti modifikovan\u00e1 data. Vyu\u017eit\u00ed zranitelnosti spo\u010d\u00edv\u00e1 ve zm\u011bn\u011b str\u00e1nkov\u00e9ho cache pro spustiteln\u00fd soubor s flagem suid root, p\u0159edem p\u0159e\u010dten\u00e9ho pro um\u00edst\u011bn\u00ed do str\u00e1nkov\u00e9ho cache. V navr\u017een\u00e9m exploit\u011b byly prvn\u00edch 192 bajt\u016f souboru \/usr\/bin\/su p\u0159eps\u00e1ny k\u00f3dem pro spu\u0161t\u011bn\u00ed \/usr\/bin\/sh. N\u00e1sledn\u00e9 spu\u0161t\u011bn\u00ed utility \u201esu\u201c vede k tomu, \u017ee do pam\u011bti bude na\u010dtena nikoli origin\u00e1ln\u00ed spustiteln\u00e1 verze ze za\u0159\u00edzen\u00ed, ale upraven\u00e1 kopie ze str\u00e1nkov\u00e9ho cache. <\/p>\n

Pro vyu\u017eit\u00ed zranitelnosti Fragnesia mus\u00ed b\u00fdt v syst\u00e9mu povoleno vytv\u00e1\u0159en\u00ed prostor\u016f jmen identifik\u00e1tor\u016f u\u017eivatel\u016f (user namespace). V Ubuntu je takov\u00e1 operace ve v\u00fdchoz\u00edm nastaven\u00ed zak\u00e1zan\u00e1, ale m\u016f\u017ee b\u00fdt povolena prost\u0159ednictv\u00edm sysctl \u201ekernel.apparmor_restrict_unprivileged_userns=0\u201c nebo profil\u016f AppArmor. V ostatn\u00edch distribuc\u00edch dostupnost \u201euser namespace\u201c pro nep\u0159id\u011blen\u00e9 u\u017eivatele z\u00e1vis\u00ed na nastaven\u00ed sysctl \u201ekernel.unprivileged_userns_clone\u201c (pokud je 0, je zak\u00e1z\u00e1no). <\/p>\n

Aktualizace s opravami pro j\u00e1dro Linuxu a bal\u00ed\u010dky s j\u00e1drem v distribuc\u00edch dosud nebyly zve\u0159ejn\u011bny. Stav odstran\u011bn\u00ed zranitelnost\u00ed v distribuc\u00edch lze posoudit na t\u011bchto str\u00e1nk\u00e1ch: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Gentoo, Arch, Fedora. Jako obch\u00e1zej\u00edc\u00ed ochranu lze blokovat na\u010d\u00edt\u00e1n\u00ed modul\u016f j\u00e1dra esp4 a esp6: <\/p>\n

sh -c \u201eprintf \u2018install esp4 \/bin\/false\\ninstall esp6 \/bin\/false\\n\u2019 > \/etc\/modprobe.d\/dirtyfrag.conf; rmmod esp4 esp6 2>\/dev\/null; true\u201c
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0434\u0432\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-46300), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Fragnesia \u0438\u043b\u0438 Copy Fail 3.0. \u0421\u0443\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430 \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c Copy Fail \u0438 Dirty Frag. \u041a\u0430\u043a \u0438 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 Dirty Frag \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 xfrm-ESP, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170701","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Fragnesia \u2014 zranitelnost v j\u00e1d\u0159e Linuxu, kter\u00e1 umo\u017e\u0148uje z\u00edskat root p\u0159es zm\u011bnu str\u00e1nkov\u00e9ho cache | ProHoster","description":"V j\u00e1d\u0159e Linux byla zji\u0161t\u011bna \u010dtvrt\u00e1 zranitelnost za posledn\u00ed dva t\u00fddny (CVE-2026-46300), kter\u00e1 umo\u017e\u0148uje nep\u0159ivilegovan\u00e9mu u\u017eivateli z\u00edskat pr\u00e1va root p\u0159episov\u00e1n\u00edm dat ve str\u00e1nkov\u00e9m cache.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Fragnesia \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root \u0447\u0435\u0440\u0435\u0437 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u0433\u043e \u043a\u044d\u0448\u0430 | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0434\u0432\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-46300), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-15T10:24:29+00:00","article:modified_time":"2026-05-15T10:24:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/170701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=170701"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/170701\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=170701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=170701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=170701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}