{"id":170805,"date":"2026-05-16T06:24:28","date_gmt":"2026-05-16T04:24:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-linux-podsisteme-pidfd-pozvolyayushhaya-prochitat-nedostupnye-polzovatelyu-fajly"},"modified":"2026-05-16T06:24:28","modified_gmt":"2026-05-16T04:24:28","slug":"uyazvimost-v-linux-podsisteme-pidfd-pozvolyayushhaya-prochitat-nedostupnye-polzovatelyu-fajly","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-linux-podsisteme-pidfd-pozvolyayushhaya-prochitat-nedostupnye-polzovatelyu-fajly","title":{"rendered":"A vulnerability in the Linux pidfd subsystem allowing unauthorized access to user-inaccessible files.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A fifth critical vulnerability has been identified in the Linux kernel within the last two weeks, allowing a user to elevate their privileges within the system. Two working exploits have been published: sshkeysign_pwn allows an unprivileged user to read the contents of private host SSH keys \/etc\/ssh\/ssh_host_*_key, while chage_pwn \u2014 reads the contents of the \/etc\/shadow file containing user password hashes. <\/p>\n
Details about the vulnerability were not scheduled for disclosure, but one security researcher was able to determine the nature of the vulnerability based on a proposed kernel patch, which allows reading files accessible only to the root user, such as \/etc\/shadow. The change added to the kernel corrected the logic of using the get_dumpable() function in ptrace when determining access level in the ptrace_may_access() function. <\/p>\n
The vulnerability itself is caused by a race condition allowing unprivileged access to a file descriptor pidfd after accessing a file from a suid root process. At the moment between opening the file and dropping privileges in the suid program (for example, via the setreuid function), a situation arises where the application that launched the suid root program can access a file opened in the suid program through the pidfd descriptor, even if file access permissions do not allow it. <\/p>\n
The exploitation window arises because the function \"__ptrace_may_access()\" bypasses the access check to the file if the task->mm field is set to NULL after executing exit_mm() but before calling exit_files(). Currently, the system call pidfd_getfd believes that the user identifier (uid) of the calling process matches the identifier permitted to access the file. Notably, the issue was previously raised back in 2020, but it remained unaddressed. <\/p>\n
In the exploit that retrieves the contents of \/etc\/shadow, the attack consists of repeatedly launching the \/usr\/bin\/chage application with the suid root flag, which reads the contents of \/etc\/shadow. After the process forks, the pidfd_open system call is executed, and available pidfd descriptors are cyclically iterated through the pidfd_getfd system call and checked via \/proc\/self\/fd. In the sshkeysign_pwn exploit, similar manipulations are carried out with the suid root program ssh-keysign. <\/p>\n
The CVE identifier has not yet been assigned, and updates to the kernel and packages in the distributions have not been published. The vulnerabilities in the released kernels 7.0.7, 6.18.30, and 6.12.88, a few hours ago, have not been fixed. As of the time of this news, only a patch can be used. Possible workarounds to block the vulnerability are being discussed, such as setting sysctl kernel.yama.ptrace_scope=3 or removing the suid root flag from executable files in the system (at least from the utilities ssh-keysign and chage, used in exploits).