{"id":172668,"date":"2026-05-19T06:24:52","date_gmt":"2026-05-19T04:24:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly"},"modified":"2026-05-19T12:52:18","modified_gmt":"2026-05-19T10:52:18","slug":"v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","title":{"rendered":"V syst\u00e9mu Linux byla uzav\u0159ena zranitelnost ssh-keysign-pwn, kter\u00e1 umo\u017e\u0148uje m\u00edstn\u00edm u\u017eivatel\u016fm \u010d\u00edst root soubory.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ve francouzsk\u00e9m j\u00e1dru Linux byla opravena zranitelnost, kter\u00e1 dostala neofici\u00e1ln\u00ed n\u00e1zev. ssh-keysign-pwn<\/strong>. Probl\u00e9m umo\u017e\u0148uje m\u00edstn\u00edmu nepriviligovan\u00e9mu u\u017eivateli \u010d\u00edst soubory, kter\u00e9 by m\u011bly b\u00fdt dostupn\u00e9 pouze pro roota, v\u010detn\u011b soukrom\u00fdch SSH hostitelsk\u00fdch kl\u00ed\u010d\u016f a v n\u011bkter\u00fdch sc\u00e9n\u00e1\u0159\u00edch tak\u00e9 \/etc\/shadow. V dob\u011b publikace nebylo pro tento probl\u00e9m je\u0161t\u011b p\u0159id\u011bleno samostatn\u00e9 CVE.<\/p>\n

<\/p>\n

Navzdory n\u00e1zvu se nejedn\u00e1 o chybu v OpenSSH jako s\u00ed\u0165ov\u00e9m serveru sshd, ale o defekt<\/a> v logice j\u00e1dra Linuxu, souvisej\u00edc\u00ed s kontrolami ptrace a p\u0159\u00edstupem k souborov\u00fdm descriptor\u016fm jin\u00e9ho procesu prost\u0159ednictv\u00edm pidfd_getfd(2). N\u00e1stroj OpenSSH ssh-keysign se stal jedn\u00edm z usnadn\u011bn\u00fdch p\u0159\u00edklad\u016f zneu\u017eit\u00ed, proto\u017ee pracuje se soukrom\u00fdmi hostitelsk\u00fdmi kl\u00ed\u010di, kter\u00e9 obvykle pat\u0159\u00ed rootovi a nejsou dostupn\u00e9 b\u011b\u017en\u00fdm u\u017eivatel\u016fm.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Podstata chyby<\/a> spo\u010d\u00edv\u00e1 v tom, \u017ee funkce __ptrace_may_access() nespr\u00e1vn\u011b zpracov\u00e1vala stav procesu, jeho\u017e struktura pam\u011bti mm ji\u017e zmizela, ale st\u00e1le z\u016fst\u00e1valy otev\u0159en\u00e9 souborov\u00e9 deskriptory. B\u011bhem ukon\u010dov\u00e1n\u00ed procesu j\u00e1dro vol\u00e1 exit_mm() d\u0159\u00edve, ne\u017e zav\u0159e soubory prost\u0159ednictv\u00edm exit_files(). V t\u00e9to kr\u00e1tk\u00e9 dob\u011b se proces ji\u017e jev\u00ed jako nemaj\u00edc\u00ed b\u011b\u017en\u00fd u\u017eivatelsk\u00fd adresn\u00ed prostor, ale jeho otev\u0159en\u00e9 soubory je\u0161t\u011b existuj\u00ed. Z toho d\u016fvodu mohla kontrola stavu \u201edumpable\u201c b\u00fdt obejita, a pidfd_getfd() z\u00edskat p\u0159\u00edstup k ciz\u00edmu souborov\u00e9mu descriptoru p\u0159i shoduj\u00edc\u00edm se UID.<\/p>\n

<\/noindex> <\/p>\n

Praktick\u00fd sc\u00e9n\u00e1\u0159 se stav\u00ed kolem setuid program\u016f, kter\u00e9 nejprve otev\u0159ou citliv\u00fd soubor s pr\u00e1vy roota, pot\u00e9 sni\u017euj\u00ed privilegium a kon\u010d\u00ed, st\u00e1le m\u00edt otev\u0159en\u00fd descriptor. V publikovan\u00e9m popisu je jako p\u0159\u00edklad uveden ssh-keysign: otv\u00edr\u00e1 \/etc\/ssh\/ssh_host_{ecdsa,ed25519,rsa}_key, pot\u00e9 sni\u017euje pr\u00e1va a m\u016f\u017ee skon\u010dit, pokud je EnableSSHKeysign vypnut. Tyto kl\u00ed\u010de by m\u011bly b\u00fdt dostupn\u00e9 pouze rootovi, proto\u017ee se pou\u017e\u00edvaj\u00ed pro host-based autentizaci.<\/p>\n

Druh\u00fdm p\u0159\u00edkladem je chage, kter\u00fd m\u016f\u017ee otev\u0159\u00edt \/etc\/shadow, pot\u00e9 sn\u00ed\u017eit efektivn\u00ed pr\u00e1va a skon\u010dit. V d\u016fsledku toho \u00fatok nemus\u00ed ihned poskytnout shell s pr\u00e1vy roota, ale umo\u017e\u0148uje obdr\u017eet obsah soubor\u016f, kter\u00e9 se obvykle pova\u017euj\u00ed za kriticky chr\u00e1n\u011bn\u00e9. \u00danik \/etc\/shadow je nebezpe\u010dn\u00fd mo\u017enost\u00ed n\u00e1sledn\u00e9ho offline l\u00e1m\u00e1n\u00ed hesel, a \u00fanik soukrom\u00fdch SSH hostitelsk\u00fdch kl\u00ed\u010d\u016f p\u0159edstavuje riziko podvr\u017een\u00ed hostitele nebo prov\u00e1d\u011bn\u00ed \u00fatok\u016f na d\u016fv\u011bryhodn\u00e9 SSH skripty.<\/p>\n

Oprava byla ji\u017e zahrnuta do hlavn\u00ed v\u011btve Linuxu. Komit 31e62c2ebbfd s n\u00e1zvem ptrace: m\u00edrn\u011b rozumn\u011bj\u0161\u00ed logika ‘get_dumpable()’ m\u011bn\u00ed chov\u00e1n\u00ed kontroly dumpability: j\u00e1dro nyn\u00ed uchov\u00e1v\u00e1 stav user_dumpable p\u0159i zmizen\u00ed mm a vy\u017eaduje spr\u00e1vnou kontrolu CAP_SYS_PTRACE pro obch\u00e1zen\u00ed. Patch se dot\u00fdk\u00e1 include\/linux\/sched.h, kernel\/exit.c a kernel\/ptrace.c.<\/p>\n

Zranitelnost byla nahl\u00e1\u0161ena spole\u010dnost\u00ed Qualys a opravena Linusem Torvaldsem 14. kv\u011btna 2026. Phoronix uv\u00e1d\u00ed, \u017ee v dob\u011b publikace probl\u00e9m zasahoval v\u0161echny verze j\u00e1dra Linux a\u017e po aktu\u00e1ln\u00ed stav mainline v\u011btve p\u0159ed proveden\u00edm opravy. Autor PoC tak\u00e9 uv\u00e1d\u00ed, \u017ee zraniteln\u00e1 jsou j\u00e1dra p\u0159ed commitem 31e62c2ebbfd, v\u010detn\u011b stabiln\u00edch v\u011btv\u00ed k datu 14. kv\u011btna.<\/p>\n

<\/p>\n

Je tak\u00e9 d\u016fle\u017eit\u00e9 poznamenat, \u017ee k \u00fatoku nen\u00ed nutn\u00e9 na\u010d\u00edtat specifick\u00e9 moduly j\u00e1dra, jak tomu bylo u \u0159ady ned\u00e1vn\u00fdch LPE zranitelnost\u00ed. Sta\u010d\u00ed m\u00edstn\u00ed neprivilegovan\u00fd p\u0159\u00edstup k syst\u00e9mu a p\u0159\u00edtomnost vhodn\u00e9ho privilegovan\u00e9ho pomocn\u00e9ho procesu. V\u00fdvoj\u00e1\u0159 Debianu Daniel Baumann poznamenal<\/a>, \u017ee tento probl\u00e9m by m\u011bl b\u00fdt vy\u0159e\u0161en aktualizac\u00ed j\u00e1dra a n\u00e1sledn\u00fdm restartem do opraven\u00e9ho j\u00e1dra.<\/p>\n

<\/noindex> <\/p>\n

V publikovan\u00e9m repozit\u00e1\u0159i s demonstrac\u00ed byla potvrzena kontrola na Raspberry Pi OS Bookworm s j\u00e1drem 6.12.75, Debian 13, Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04, Arch a CentOS 9. K tomuto seznamu je t\u0159eba p\u0159istupovat jako k \u00fadaj\u016fm autora PoC, nikoli jako k vy\u010derp\u00e1vaj\u00edc\u00edmu seznamu: proto\u017ee chyba le\u017e\u00ed v obvykl\u00e9 logice j\u00e1dra, skute\u010dn\u00e9 pokryt\u00ed z\u00e1vis\u00ed na verzi j\u00e1dra a dostupnosti backportovan\u00e9 opravy u konkr\u00e9tn\u00ed distribuce.<\/p>\n

Pro administr\u00e1tory je hlavn\u00ed doporu\u010den\u00ed jednoduch\u00e9: nainstalovat aktualizovan\u00fd j\u00e1drov\u00fd bal\u00ed\u010dek ze sv\u00e9 distribuce a restartovat syst\u00e9m. Pokud existuj\u00ed d\u016fvody domn\u00edvat se, \u017ee na stroji ji\u017e m\u011bl \u00fato\u010dn\u00edk lok\u00e1ln\u00ed neprivilegovan\u00fd p\u0159\u00edstup, je po aktualizaci vhodn\u00e9 zv\u00e1\u017eit i rotaci SSH host kl\u00ed\u010d\u016f a kontrolu \/etc\/shadow\/u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f, nebo\u0165 zranitelnost se t\u00fdk\u00e1 pr\u00e1v\u011b \u010dten\u00ed citliv\u00fdch soubor\u016f, nikoli pouze abstraktn\u00edho obch\u00e1zen\u00ed p\u0159\u00edstupov\u00fdch kontrol.<\/p>\n

V Debianu ji\u017e bylo zah\u00e1jeno \u00fasil\u00ed o p\u0159enos opravy: Baumann ozn\u00e1mil cherry-pick upstream commitu v trixie-fastforward-backports a odesl\u00e1n\u00ed merge requestu pro Debian sid. V merge requestu je p\u0159\u00edmo uvedeno, \u017ee se p\u0159en\u00e1\u0161\u00ed commit 31e62c2 pro opravu ptrace logiky dumpability, kter\u00e1 umo\u017e\u0148uje \u010d\u00edst root soubory neprivilegovan\u00e9mu u\u017eivateli.<\/p>\n

Zdroj: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0447\u0438\u0442\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e root, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 SSH host-\u043a\u043b\u044e\u0447\u0438 \u0438, \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445, \/etc\/shadow. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 CVE \u0434\u043b\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0435\u0449\u0451 \u043d\u0435 \u0431\u044b\u043b \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d. \u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435, \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043d\u0435 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 OpenSSH \u043a\u0430\u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172668","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V Linuxu byla uzav\u0159ena zranitelnost ssh-keysign-pwn, kter\u00e1 umo\u017enila lok\u00e1ln\u00edm u\u017eivatel\u016fm \u010d\u00edst root soubory | ProHoster","description":"Ve j\u00e1d\u0159e Linux byla opravena zranitelnost, kter\u00e1 z\u00edskala neofici\u00e1ln\u00ed n\u00e1zev ssh-keysign-pwn.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c ssh-keysign-pwn, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0447\u0438\u0442\u0430\u0442\u044c root-\u0444\u0430\u0439\u043b\u044b | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-19T04:24:52+00:00","article:modified_time":"2026-05-19T10:52:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/172668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=172668"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/172668\/revisions"}],"predecessor-version":[{"id":172737,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/172668\/revisions\/172737"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=172668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=172668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=172668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}