{"id":182332,"date":"2026-06-27T08:48:07","date_gmt":"2026-06-27T06:48:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha"},"modified":"2026-06-27T08:48:07","modified_gmt":"2026-06-27T06:48:07","slug":"pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha","title":{"rendered":"PEdit-CoW a DirtyClone \u2014 zranitelnosti v j\u00e1d\u0159e Linux, kter\u00e9 umo\u017e\u0148uj\u00ed z\u00edsk\u00e1n\u00ed root p\u0159\u00edstupu prost\u0159ednictv\u00edm zm\u011bny str\u00e1nkov\u00e9ho cache","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Byly odhaleny informace o dvou nov\u00fdch zranitelnostech v j\u00e1d\u0159e Linux, kter\u00e9 umo\u017e\u0148uj\u00ed nep\u0159id\u011blen\u00e9mu u\u017eivateli z\u00edskat pr\u00e1va root t\u00edm, \u017ee p\u0159ep\u00ed\u0161e data v str\u00e1nkov\u00e9m cache. Pro ob\u011b zranitelnosti byly p\u0159ipraveny funk\u010dn\u00ed exploit.<\/p>\n
\n
PEdit-CoW (CVE-2026-46331, exploit 1, exploit 2) \u2014 chyba p\u0159i uplatn\u011bn\u00ed mechanismu copy-on-write v k\u00f3du pro zm\u011bnu hlavi\u010dek paket\u016f (act_pedit), pou\u017e\u00edvan\u00e9m v pl\u00e1nova\u010di s\u00ed\u0165ov\u00fdch paket\u016f (net\/sched), umo\u017e\u0148uje zapisovat data mimo vyhrazen\u00fd buffer, co\u017e m\u016f\u017ee b\u00fdt pou\u017eito k p\u0159eps\u00e1n\u00ed dat ve str\u00e1nkov\u00e9m cache na vybran\u00e9m posunu. Chyba je zp\u016fsobena t\u00edm, \u017ee kontrola povolen\u00e9 oblasti pro z\u00e1pis dat byla provedena bez zohledn\u011bn\u00ed toho, \u017ee posun do editovan\u00fdch pol\u00ed se m\u016f\u017ee b\u011bhem prov\u00e1d\u011bn\u00ed operace zm\u011bnit.\n
Probl\u00e9m se vyskytuje od j\u00e1dra Linux 5.18 a byl odstran\u011bn ve verz\u00edch 7.1, 7.0.13, 6.18.36 a 6.12.94. Byla ozn\u00e1mena mo\u017enost zneu\u017eit\u00ed probl\u00e9mu v RHEL 8\/9\/10, Debian 11\/12, openSUSE Leap 15.6, SUSE Linux 15-SP7\/16.0 a Ubuntu 18.04-25.10 (ve verzi Ubuntu 26.4 je ve v\u00fdchoz\u00edm nastaven\u00ed blokov\u00e1no vytv\u00e1\u0159en\u00ed user namespace). Jako obranou cestou se doporu\u010duje zablokovat na\u010d\u00edt\u00e1n\u00ed j\u00e1drov\u00e9ho modulu act_pedit (p\u0159estanou fungovat pravidla pro omezen\u00ed provozu a p\u0159episov\u00e1n\u00ed hlavi\u010dek p\u0159es \u201etc pedit\u201c).<\/p>\n
DirtyClone (CVE-2026-43503, exploit) \u2014 obran\u00e1 cesta pro zneu\u017eit\u00ed zranitelnosti Dirty Frag v modulu xfrm-ESP, pou\u017e\u00edvan\u00e9m pro urychlov\u00e1n\u00ed operac\u00ed \u0161ifrov\u00e1n\u00ed v IPsec pomoc\u00ed protokolu ESP (Encapsulating Security Payload). Pro klonov\u00e1n\u00ed struktury skb v nov\u00e9m exploit\u011b se pou\u017e\u00edv\u00e1 manipulace s TEE roz\u0161\u00ed\u0159en\u00edm k netfilter (modul xt_TEE), kter\u00fd prov\u00e1d\u00ed operaci klonov\u00e1n\u00ed s\u00ed\u0165ov\u00fdch paket\u016f.\n
Zranitelnost byla odstran\u011bna v vyd\u00e1n\u00edch j\u00e1dra Linux 7.1, 7.0.10, 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91 a 6.18.33. Probl\u00e9m se projevuje v Debianu, Ubuntu, Fedo\u0159e, \nRHEL a SUSE. Jako obranou metodou blokov\u00e1n\u00ed zranitelnosti je mo\u017en\u00e9 zak\u00e1zat na\u010d\u00edt\u00e1n\u00ed modul\u016f j\u00e1dra esp4 a esp6.<\/p>\n<\/ul>\n
Pro zneu\u017eit\u00ed obou zranitelnost\u00ed jsou vy\u017eadov\u00e1na pr\u00e1va p\u0159\u00edstupu CAP_NET_ADMIN, kter\u00e1 m\u016f\u017ee neprivilegovan\u00fd u\u017eivatel z\u00edskat vytvo\u0159en\u00edm prostor\u016f jmen identifik\u00e1tor\u016f u\u017eivatel\u016f (user namespace). V Ubuntu je takov\u00e1 operace ve v\u00fdchoz\u00edm nastaven\u00ed zak\u00e1z\u00e1na, ale m\u016f\u017ee b\u00fdt povolena pomoc\u00ed sysctl \u201ekernel.apparmor_restrict_unprivileged_userns=0\u201c nebo profil\u016f AppArmor. V ostatn\u00edch distribuc\u00edch dostupnost \u201euser namespace\u201c neprivilegovan\u00fdm u\u017eivatel\u016fm z\u00e1vis\u00ed na nastaven\u00ed sysctl \u201ekernel.unprivileged_userns_clone\u201c (pokud je 0, je zak\u00e1z\u00e1no). <\/p>\n
Exploatace zranitelnost\u00ed spo\u010d\u00edv\u00e1 v \u010dten\u00ed souboru programu \/bin\/su s flagem suid root, aby se usadil ve str\u00e1nkov\u00e9m cache a nahradil v n\u011bm \u010d\u00e1st k\u00f3du programu k\u00f3dem pro spu\u0161t\u011bn\u00ed \/bin\/sh. N\u00e1sledn\u00e9 spu\u0161t\u011bn\u00ed programu povede k tomu, \u017ee do pam\u011bti nebude na\u010dten origin\u00e1ln\u00ed spustiteln\u00fd soubor z \u00falo\u017ei\u0161t\u011b, ale pozm\u011bn\u011bn\u00e1 kopie ze str\u00e1nkov\u00e9ho cache. <\/p>\n
D\u00e1le lze zm\u00ednit vytvo\u0159en\u00ed exploit\u016f pro zranitelnost CVE-2026-23111 v subsyst\u00e9mu nf_tables, kter\u00e1 byla odstran\u011bna ve febru\u00e1rov\u00fdch aktualizac\u00edch j\u00e1dra Linux. Zranitelnost je zp\u016fsobena p\u0159\u00edstupem k pam\u011bti po jej\u00edm uvoln\u011bn\u00ed (use-after-free) a umo\u017e\u0148uje neprivilegovan\u00e9mu u\u017eivateli z\u00edskat pr\u00e1va root v syst\u00e9mu. Pro \u00fatok mus\u00ed m\u00edt u\u017eivatel tak\u00e9 mo\u017enost vytv\u00e1\u0159et prostory jmen identifik\u00e1tor\u016f u\u017eivatel\u016f (user namespace). Fungov\u00e1n\u00ed exploitu bylo demonstrov\u00e1no v \nDebian 12\/13 a Ubuntu 22.04\/24.04. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"