{"id":172668,"date":"2026-05-19T06:24:52","date_gmt":"2026-05-19T04:24:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly"},"modified":"2026-05-19T12:52:18","modified_gmt":"2026-05-19T10:52:18","slug":"v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","title":{"rendered":"A vulnerability ssh-keysign-pwn has been closed in Linux, allowing local users to read root files.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A vulnerability in the Linux kernel has been patched, unofficially named ssh-keysign-pwn<\/strong>. The issue allows a local unprivileged user to read files that should only be accessible to root, including private SSH host keys and, in certain scenarios, \/etc\/shadow. At the time of publication, a separate CVE for the issue had not yet been assigned.<\/p>\n

<\/p>\n

Despite the name, this is not an error in OpenSSH as the SSH daemon sshd, but rather a defect<\/a> in the logic of the Linux kernel related to ptrace checks and access to file descriptors of another process via pidfd_getfd(2). The OpenSSH utility ssh-keysign turned out to be one of the convenient examples for exploitation because it works with private host keys, which usually belong to root and are inaccessible to ordinary users.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

The essence of the bug<\/a> lies in the fact that the __ptrace_may_access() function incorrectly handled the state of a process whose memory structure mm had already disappeared, but had remaining open file descriptors. During process termination, the kernel calls exit_mm() before closing files through exit_files(). In this brief period, the process already appears to lack a normal user address space, but its open files still exist. This could lead to the 'dumpable' state check being bypassed, and pidfd_getfd() accessing another's file descriptor with a matching UID.<\/p>\n

<\/noindex> <\/p>\n

The practical scenario revolves around setuid programs that first open a sensitive file with root permissions, then drop privileges and terminate while still having an open descriptor. In the published description, ssh-keysign is cited as an example: it opens \/etc\/ssh\/ssh_host_{ecdsa,ed25519,rsa}_key, after which it drops rights and can terminate if EnableSSHKeysign is disabled. These keys should only be accessible to root, as they are used for host-based authentication.<\/p>\n

Another example is chage, which may open \/etc\/shadow, then drop effective rights and terminate. As a result, the attack does not necessarily provide immediate root shell access but allows the retrieval of file contents that are generally considered critically confidential. The leakage of \/etc\/shadow is dangerous due to the possibility of subsequent offline password cracking, and the leakage of private SSH host keys poses the risk of host impersonation or attacks on trusted SSH scenarios.<\/p>\n

The fix has already been accepted into the main branch of Linux. Commit 31e62c2ebbfd with the title ptrace: slightly saner 'get_dumpable()' logic changes the behavior of dumpability checks: the kernel now preserves the user_dumpable state when mm disappears and requires a proper CAP_SYS_PTRACE check for bypassing. The patch affects include\/linux\/sched.h, kernel\/exit.c, and kernel\/ptrace.c.<\/p>\n

The vulnerability was reported by Qualys and fixed by Linus Torvalds on May 14, 2026. Phoronix notes that at the time of publication, the issue affected all releases of the Linux kernel up to the current state of the mainline tree before the fix was applied. The PoC author also indicates that kernels prior to commit 31e62c2ebbfd are vulnerable, including stable branches as of May 14.<\/p>\n

<\/p>\n

It is particularly important that exploitation does not require loading specific kernel modules, as is the case with several recent LPE vulnerabilities. Local unprivileged access to the system and the presence of a suitable privileged helper process are sufficient. Debian developer Daniel Baumann noted<\/a>, that this issue should be resolved by updating the kernel and subsequently rebooting into the fixed kernel.<\/p>\n

<\/noindex> <\/p>\n

The published repository with the demonstration claims compatibility with Raspberry Pi OS Bookworm running kernel 6.12.75, Debian 13, Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04, Arch, and CentOS 9. This list should be regarded as the author's PoC data rather than an exhaustive enumeration: since the error resides in the general kernel logic, actual coverage depends on the kernel version and the presence of backport fixes by specific distributions.<\/p>\n

For administrators, the main recommendation is simple: install the updated kernel package from your distribution and reboot the system. If there are grounds to believe that the machine may have already had local unprivileged access from an attacker, consider additionally rotating SSH host keys and checking \/etc\/shadow accounts after the update, as the vulnerability is associated with reading sensitive files, not just abstract access bypass.<\/p>\n

In Debian, work has already begun to incorporate the fix: Baumann reported the cherry-pick of the upstream commit into trixie-fastforward-backports and the submission of a merge request for Debian sid. The merge request specifically states that commit 31e62c2 is being transferred to fix the ptrace dumpability logic, allowing unprivileged users to read root files.<\/p>\n

Source: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0447\u0438\u0442\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e root, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 SSH host-\u043a\u043b\u044e\u0447\u0438 \u0438, \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445, \/etc\/shadow. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 CVE \u0434\u043b\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0435\u0449\u0451 \u043d\u0435 \u0431\u044b\u043b \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d. \u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435, \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043d\u0435 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 OpenSSH \u043a\u0430\u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172668","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A vulnerability ssh-keysign-pwn has been closed in Linux, allowing local users to read root files | ProHoster","description":"A vulnerability in the Linux kernel has been fixed, unofficially named ssh-keysign-pwn.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c ssh-keysign-pwn, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0447\u0438\u0442\u0430\u0442\u044c root-\u0444\u0430\u0439\u043b\u044b | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-19T04:24:52+00:00","article:modified_time":"2026-05-19T10:52:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/172668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=172668"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/172668\/revisions"}],"predecessor-version":[{"id":172737,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/172668\/revisions\/172737"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=172668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=172668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=172668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}