{"id":172665,"date":"2026-05-19T00:24:34","date_gmt":"2026-05-18T22:24:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-19T00:24:34","modified_gmt":"2026-05-18T22:24:34","slug":"dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"DirtyDecrypt \u2014 en ny s\u00e5rbarhed af klassen Copy Fail, der giver root-rettigheder i Linux.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I Linux-kernen er der opdaget en s\u00e5rbarhed, der minder om s\u00e5rbarhederne Copy Fail, Dirty Frag og Fragnesia, som g\u00f8r det muligt for en ikke-privilegeret bruger at opn\u00e5 root-rettigheder ved at overskrive data i sidecachen. S\u00e5rbarheden er givet kodebetegnelsen DirtyDecrypt (det samme problem omtales ogs\u00e5 som DirtyCBC). En prototype af et exploit er tilg\u00e6ngelig. <\/p>\n

CVE-identifikatoren n\u00e6vnes ikke i bem\u00e6rkningerne til exploit-en; det er kun angivet, at forskerne opdagede problemet den 9. maj, hvorefter de informerede udviklerne af kernen, som svarede, at deres opdagelse duplikerede en anden rapport om en allerede rettet s\u00e5rbarhed. Da patchen med rettelsen allerede var inkluderet i kernen, besluttede forskerne at offentligg\u00f8re det exploit, de havde udviklet. If\u00f8lge beskrivelsen inden i exploit-en anvendes CVE-2026-31635, hvor rettelsen blev accepteret i kernen i april og blev en del af udgaven 7.0.0, som blev udgivet den 18. april i version 6.18.23. Problemet optr\u00e6der fra og med kernen 6.16. <\/p>\n

Som som med r\u00e6kken af s\u00e5rbarheder Dirty Frag, er den nye s\u00e5rbarhed til stede i RxRPC-driveren, som implementerer familien af sockets AF_RXRPC og den tilh\u00f8rende RPC-protokol, der fungerer over UDP. Problemet skyldes en fejl i datast\u00f8rrelseskontrollen i funktionen rxgk_verify_response() \u2014 i stedet for at kontrollere «if (auth_len > len)» blev der i koden angivet «if (auth_len < len)», hvilket f\u00f8rte til, at funktionen rxgk_decrypt_skb() fik data med en st\u00f8rrelse, der oversteg det acceptable. Under udf\u00f8relsen af funktionen rxgk_decrypt_skb() blev data dekrypteret ved at inds\u00e6tte \u00e6ndringer direkte i sidens cache for at undg\u00e5 un\u00f8dig buffring. P\u00e5 grund af den forkerte st\u00f8rrelseskontrol opstod der en mulighed for at overskrive dataene i sidens cache p\u00e5 et valgt offset. <\/p>\n

Udnyttelsen af s\u00e5rbarheden g\u00e5r ud p\u00e5 at l\u00e6se programfilen med suid root-flaget (for at f\u00e5 den i sidens cache) og erstatte en del af programmets kode i sidens cache med kode til at k\u00f8re \/usr\/bin\/sh. Den efterf\u00f8lgende k\u00f8rsel af programmet vil resultere i, at en \u00e6ndret kopi fra sidens cache indl\u00e6ses i hukommelsen i stedet for den originale eksekverbare fil fra lageret. Som suid-programmer i exploit'en er der mulighed for at bruge «\/usr\/bin\/su», «\/bin\/su», «\/usr\/bin\/mount», «\/usr\/bin\/passwd» og «\/usr\/bin\/chsh». <\/p>\n

For the vulnerability to be exploited, the CONFIG_RXGK option must be enabled when compiling the kernel, and the rxrpc kernel module must be available for autoloading. (In some systems, it is not compiled). The status of vulnerability fixes in distributions can be assessed on the following pages: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Arch, Fedora. As a workaround, you can block the loading of the rxrpc kernel module: <\/p>\n

sh -c «printf ‘install rxrpc \/bin\/false\n’ > \/etc\/modprobe.d\/dirtydecrypt.conf; rmmod rxrpc 2>\/dev\/null; true» <\/p>\n

Derudover kan det n\u00e6vnes, at der er blevet offentliggjort patches i Linux-kernens udviklerliste, som fuldst\u00e6ndigt deaktiverer optimeringer i crypto API (AF_ALG), der bruger direkte adgang til sidens cache ved dekryptering med algoritmerne «skcipher» og «aead». Optimeringerne udelukker un\u00f8dig buffring af data, men skaber risici for alvorlige s\u00e5rbarheder. Det forventes, at deaktiveringen kun vil resultere i en ubetydelig reduktion i ydeevnen p\u00e5 grund af tilf\u00f8jelsen af en ekstra kopieringsoperation til en separat buffer. Patches er blevet accepteret af den, der underst\u00f8tter crypto API, og er inkluderet i «cryptodev»-grenen, hvor mulighederne for at overf\u00f8re til fremtidige versioner af Linux-kernen udvikles.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Copy Fail, Dirty Frag \u0438 Fragnesia \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f DirtyDecrypt (\u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u0438\u043c\u0435\u043d\u0435\u043c DirtyCBC). \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0432 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0438 \u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0443 \u043d\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043e \u043b\u0438\u0448\u044c, \u0447\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 9 \u043c\u0430\u044f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DirtyDecrypt \u2014 another Copy Fail class vulnerability granting root access in Linux | ProHoster","description":"A vulnerability has been identified in the Linux kernel, similar to the Copy Fail, Dirty Frag, and Fragnesia vulnerabilities, allowing an unprivileged user to gain root privileges by overwriting data in the page cache.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DirtyDecrypt \u2014 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u0430 Copy Fail, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0430\u0432\u0430 root \u0432 Linux | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Copy Fail, Dirty Frag \u0438 Fragnesia \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T22:24:34+00:00","article:modified_time":"2026-05-18T22:24:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/172665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=172665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/172665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=172665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=172665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=172665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}