{"id":172753,"date":"2026-05-19T18:24:36","date_gmt":"2026-05-19T16:24:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-19T18:24:36","modified_gmt":"2026-05-19T16:24:36","slug":"pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"PinTheft \u2014 den sjette s\u00e5rbarhed af Copy Fail-klassen, der giver root-rettigheder i Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Oplysninger om den sjette s\u00e5rbarhed (1, 2-3, 4, 5) er blevet offentliggjort, hvilket g\u00f8r det muligt for en ikke-privilegeret lokal bruger at opn\u00e5 root-rettigheder ved at skrive data i den side-cache. S\u00e5rbarheden har kodenavnet PinTheft. Der er tilg\u00e6ngelig en prototype af et exploit. CVE-identifikator er endnu ikke tildelt. En l\u00f8sning er i \u00f8jeblikket kun tilg\u00e6ngelig som en patch, der blev offentliggjort den 5. maj og blev accepteret i netdev-grenen den 11. maj, men ikke inkluderet i de korrigerende udgivelser af kernen. <\/p>\n
S\u00e5rbarheden er til stede i implementeringen af netv\u00e6rksprotokollen RDS (Reliable Datagram Sockets), der er designet til h\u00f8jhastigheds meddelelser mellem noder i et cluster med minimal forsinkelse og garanteret levering. Angrebet er muligt p\u00e5 systemer med den io_uring subsystem aktiveret (io_uring_disabled=0) og en kerne, der er bygget med indstillingerne CONFIG_RDS, CONFIG_RDS_TCP og CONFIG_IO_URING. For at exploit fungerer, skal der v\u00e6re en l\u00e6seadgang for en eksekverbar fil med SUID-root flag. <\/p>\n
For automatic loading of the rds_tcp kernel module, the exploit requests the transmission of data via RDS using transport SO_RDS_TRANSPORT=2. It is noted that among the tested Linux distributions, the rds kernel module is only provided in its default configuration in Arch Linux. To block the vulnerability in a roundabout way, the auto-loading of the rds and rds_tcp kernel modules can be blocked: rmmod rds_tcp rds printf 'install rds \/bin\/false\ninstall rds_tcp \/bin\/false\n' > \/etc\/modprobe.d\/pintheft.conf <\/p>\n
The vulnerability is caused by an error in the implementation of the zerocopy mechanism in the function rds_message_zcopy_from_user(), which directly modifies data in the page cache to eliminate unnecessary buffering. In case of failure, the field rm->data.op_nents was not cleared, leading to a double-free of the buffer. The emergence of an incorrect value in the reference counter could be exploited to overwrite data in the page cache through manipulation of the pointer to the fixed io_uring buffer. <\/p>\n
In other respects, the exploitation mechanism is typical for all vulnerabilities of this class \u2014 the attacker succeeds in having the program file with the suid root flag reside in the page cache, after which they replace the ELF header with code to launch \/usr\/bin\/sh. Following this manipulation, the program execution leads to loading into memory not the original executable file from storage, but a modified copy from the page cache. Unlike previous exploits, the new variant is adapted solely for attacking the 'su' utility, but can also be applied if such suid programs as mount, passwd, chsh, newgrp, umount, and pkexec exist on the system. \n Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"