{"id":170863,"date":"2026-05-18T12:24:54","date_gmt":"2026-05-18T10:24:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root"},"modified":"2026-05-18T12:24:54","modified_gmt":"2026-05-18T10:24:54","slug":"v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","title":{"rendered":"V Linuxu byla odhalena nov\u00e1 LPE zranitelnost Fragnesia, kter\u00e1 umo\u017e\u0148uje m\u00edstn\u00edmu u\u017eivateli z\u00edskat root.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V j\u00e1d\u0159e Linux byla objevena dal\u0161\u00ed zranitelnost pro m\u00edstn\u00ed zv\u00fd\u0161en\u00ed opr\u00e1vn\u011bn\u00ed, kter\u00e1 z\u00edskala n\u00e1zev Fragnesia<\/strong> a identifik\u00e1tor CVE-2026-46300<\/strong>. Probl\u00e9m se t\u00fdk\u00e1 stejn\u00e9 t\u0159\u00eddy \u00fatok\u016f na pam\u011b\u0165ovou str\u00e1nku (page cache), jak\u00e9 byly ned\u00e1vno diskutov\u00e1ny, jako nap\u0159\u00edklad Copy Fail a Dirty Frag, ale nen\u00ed to opakovan\u00e9 zve\u0159ejn\u011bn\u00ed star\u00e9 chyby: jedn\u00e1 se o samostatnou vadu v k\u00f3du XFRM ESP-in-TCP<\/strong>.<\/p>\n

Zranitelnost objevil v\u00fdzkumn\u00edk William Bowling<\/strong> z t\u00fdmu V12 Security<\/strong>. Podle zve\u0159ejn\u011bn\u00e9ho popisu umo\u017e\u0148uje Fragnesia neprivil\u00e9govan\u00e9mu m\u00edstn\u00edmu u\u017eivateli m\u011bnit obsah soubor\u016f dostupn\u00fdch pouze pro \u010dten\u00ed v pam\u011bti page cache a t\u00edm vykon\u00e1vat k\u00f3d s pr\u00e1vy root. Na rozd\u00edl od mnoha star\u00fdch LPE exploit\u016f \u00fatok nevy\u017eaduje z\u00e1vod (race condition) a je od v\u00fdzkumn\u00edk\u016f popisov\u00e1n jako deterministick\u00fd.<\/p>\n

Technicky je probl\u00e9m spojen s t\u00edm, \u017ee p\u0159i spojov\u00e1n\u00ed s\u00ed\u0165ov\u00fdch buffer\u016f j\u00e1dro mohlo ztratit znak, \u017ee fragment dat je \"sd\u00edlen\u00fd\" a souvis\u00ed s extern\u00ed str\u00e1nkou pam\u011bti, v\u010detn\u011b page cache. V navr\u017een\u00e9 oprav\u011b je to pops\u00e1no jako chyba v skb_try_coalesce(): p\u0159i p\u0159esunu paged fragments z jednoho sk_buff do druh\u00e9ho se neuchoval flag SKBFL_SHARED_FRAG. V d\u016fsledku toho mohl pozd\u011bj\u0161\u00ed k\u00f3d ESP myln\u011b pova\u017eovat buffer za bezpe\u010dn\u00fd pro zm\u011bny.<\/p>\n

Praktick\u00fd \u00fa\u010dinek spo\u010d\u00edv\u00e1 v tom, \u017ee data d\u0159\u00edve um\u00edst\u011bn\u00e1 v TCP front\u011b ze souboru mohla po p\u0159epnut\u00ed soketu do re\u017eimu espintcp j\u00e1drem zpracov\u00e1v\u00e1na jako ESP \u0161ifrovan\u00fd text. P\u0159i de\u0161ifrov\u00e1n\u00ed AES-GCM byly byty p\u0159\u00edmo m\u011bn\u011bny na str\u00e1nce page cache spojen\u00e9 se souborem. To nem\u011bn\u00ed soubor na disku, ale m\u011bn\u00ed jeho reprezentaci v pam\u011bti, dokud nen\u00ed str\u00e1nka vypu\u0161t\u011bna z cache.<\/p>\n

V publikovan\u00e9 uk\u00e1zce \u00fatoku byl jako c\u00edl pou\u017eit \/usr\/bin\/su: exploit modifikoval prvn\u00ed bajty bin\u00e1rn\u00edho souboru v page cache a pot\u00e9 spou\u0161t\u011bl zm\u011bn\u011bnou kopii v pam\u011bti, z\u00edsk\u00e1vaj\u00edc shell s pravomocemi root. P\u016fvodn\u00ed soubor na disku p\u0159itom z\u016fstal nezm\u011bn\u011bn, co\u017e \u010din\u00ed probl\u00e9m zvl\u00e1\u0161\u0165 nep\u0159\u00edjemn\u00fdm pro diagnostiku: stopy exploitace mohou zmizet po vy\u010di\u0161t\u011bn\u00ed page cache nebo restartu.<\/p>\n

Fragnesia se objevila m\u00e9n\u011b ne\u017e t\u00fdden po Dirty Frag. V V12 zd\u016fraz\u0148uj\u00ed, \u017ee se jedn\u00e1 o samostatnou chybu ve stejn\u00e9 oblasti \u00fatoku \u2014 ESP\/XFRM, a nikoli o p\u0159ejmenov\u00e1n\u00ed ji\u017e opraven\u00e9 zranitelnosti. Phoronix tak\u00e9 poznamen\u00e1v\u00e1, \u017ee v dob\u011b publikace byl k dispozici proof-of-concept a oprava p\u0159edstavovala mal\u00fd patch k net\/core\/skbuff.c, kter\u00fd se je\u0161t\u011b nedostal do hlavn\u00edch v\u011btv\u00ed j\u00e1dra.<\/p>\n

<\/p>\n

Canonical p\u0159id\u011blila CVE-2026-46300<\/a> vysokou prioritu pro Ubuntu, p\u0159i\u010dem\u017e d\u016fvodem byla ozna\u010dena \u201etrivial local privilege escalation\u201c. Na str\u00e1nce Ubuntu Security pro posti\u017een\u00e1 j\u00e1dra byl v dob\u011b aktualizace 13. kv\u011btna uveden status \u201eNeeds evaluation\u201c, a v pozn\u00e1mce bylo uvedeno, \u017ee probl\u00e9m se tak\u00e9 nach\u00e1z\u00ed v ESP modulu j\u00e1dra a m\u016f\u017ee b\u00fdt do\u010dasn\u011b zm\u00edrn\u011bn stejn\u00fdm zp\u016fsobem jako Dirty Frag.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Debian Security Tracker<\/a> v dob\u011b kontroly ozna\u010doval jako zraniteln\u00e1 j\u00e1dra ve v\u011btv\u00edch bullseye, bookworm, trixie, forky a sid; pro bal\u00ed\u010dek linux v unstable zat\u00edm nebyla uvedena opraven\u00e1 verze.<\/p>\n

<\/noindex> <\/p>\n

Do\u010dasn\u00e9 ochrann\u00e9 opat\u0159en\u00ed z\u016fst\u00e1v\u00e1 stejn\u00e9 jako pro Dirty Frag: zak\u00e1zat na\u010d\u00edt\u00e1n\u00ed modul\u016f<\/a> esp4, esp6 a rxrpc, pokud je syst\u00e9m nepot\u0159ebuje. To m\u016f\u017ee naru\u0161it funk\u010dnost IPsec tunel\u016f na uzlech, kde se pou\u017e\u00edvaj\u00ed kernel ESP, strongSwan, Libreswan nebo podobn\u00e9 konfigurace, proto na VPN br\u00e1n\u00e1ch by toto opat\u0159en\u00ed m\u011blo b\u00fdt uplatn\u011bno pouze po posouzen\u00ed dopad\u016f.<\/p>\n

<\/noindex> <\/p>\n

P\u0159\u00edklad do\u010dasn\u00e9ho zm\u00edrn\u011bn\u00ed pro administr\u00e1tory:<\/p>\n

sudo sh -c \"printf 'install esp4 \/bin\/falseninstall esp6 \/bin\/falseninstall rxrpc \/bin\/falsen' > \/etc\/modprobe.d\/dirtyfrag.conf\" sudo rmmod esp4 esp6 rxrpc 2>\/dev\/null || true <\/p>\n

Pokud existuje podez\u0159en\u00ed, \u017ee syst\u00e9m ji\u017e mohl b\u00fdt napaden, samotn\u00e9 zablokov\u00e1n\u00ed modul\u016f nesta\u010d\u00ed: proto\u017ee ve\u0159ejn\u00e1 demonstrace m\u011bn\u00ed spustiteln\u00fd soubor p\u0159\u00edmo v page cache, administr\u00e1to\u0159i doporu\u010duj\u00ed vypr\u00e1zdnit cache str\u00e1nek nebo restartovat syst\u00e9m po uplatn\u011bn\u00ed ochrann\u00fdch opat\u0159en\u00ed. CloudLinux jasn\u011b uv\u00e1d\u00ed, \u017ee po exploataci \/usr\/bin\/su m\u016f\u017ee z\u016fstat zm\u011bn\u011bn v pam\u011bti a\u017e do vy\u0159azen\u00ed odpov\u00eddaj\u00edc\u00edch str\u00e1nek.<\/p>\n

Pro odstran\u011bn\u00ed do\u010dasn\u00e9ho pravidla po instalaci opraven\u00e9ho j\u00e1dra lze odstranit vytvo\u0159en\u00fd soubor:<\/p>\n

sudo rm \/etc\/modprobe.d\/dirtyfrag.conf <\/p>\n

Hlavn\u00ed doporu\u010den\u00ed z\u016fst\u00e1v\u00e1 standardn\u00ed: nainstalovat opraven\u00e9 j\u00e1dro od sv\u00e9ho distribuce a restartovat syst\u00e9m. P\u0159ed aktualizac\u00ed p\u0159edstavuj\u00ed nejvy\u0161\u0161\u00ed riziko v\u00edceu\u017eivatelsk\u00e9 servery, CI b\u011b\u017eci, sd\u00edlen\u00fd hosting, kontejnerov\u00e9 build farmy a jak\u00e9koli stroje, kde mohou neprivilegovan\u00ed nebo \u010d\u00e1ste\u010dn\u011b d\u016fv\u011bryhodn\u00ed u\u017eivatel\u00e9 vykon\u00e1vat m\u00edstn\u00ed k\u00f3d.<\/p>\n

Zdroj: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Fragnesia \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2026-46300. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 page cache, \u0447\u0442\u043e \u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u0432\u0448\u0438\u0435\u0441\u044f Copy Fail \u0438 Dirty Frag, \u043d\u043e \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0441\u0442\u0430\u0440\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438: \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043e\u0431 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u043c \u0434\u0435\u0444\u0435\u043a\u0442\u0435 \u0432 \u043a\u043e\u0434\u0435 XFRM ESP-in-TCP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c William Bowling […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170863","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 V Linuxu byla odhalena nov\u00e1 LPE zranitelnost Fragnesia, kter\u00e1 umo\u017e\u0148uje lok\u00e1ln\u00edmu u\u017eivateli z\u00edskat root | ProHoster","description":"V j\u00e1d\u0159e Linuxu byla odhalena dal\u0161\u00ed zranitelnost lok\u00e1ln\u00edho zv\u00fd\u0161en\u00ed opr\u00e1vn\u011bn\u00ed s n\u00e1zvem Fragnesia a identifik\u00e1torem CVE-2026-46300.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Fragnesia, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Fragnesia \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2026-46300.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T10:24:54+00:00","article:modified_time":"2026-05-18T10:24:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/170863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=170863"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/170863\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=170863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=170863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=170863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}