{"id":172753,"date":"2026-05-19T18:24:36","date_gmt":"2026-05-19T16:24:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-19T18:24:36","modified_gmt":"2026-05-19T16:24:36","slug":"pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"PinTheft \u2014 the sixth vulnerability of the Copy Fail class, providing root rights in Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Information has been revealed about the sixth vulnerability (1, 2-3, 4, 5) that allows an unprivileged local user to gain root privileges by overwriting data in the page cache. This vulnerability has been code-named PinTheft. A prototype exploit is available. The CVE identifier has not yet been assigned. A fix is currently available only as a patch, which was published on May 5 and accepted into the netdev branch on May 11, but has not been included in kernel patch releases. <\/p>\n
The vulnerability exists in the implementation of the RDS (Reliable Datagram Sockets) network protocol, intended for high-speed message exchange between nodes in a cluster, with minimal delay and guaranteed delivery. An attack is possible on systems with the io_uring subsystem enabled (io_uring_disabled=0) and a kernel compiled with the CONFIG_RDS, CONFIG_RDS_TCP, and CONFIG_IO_URING options. For the exploit to work, a readable executable file with the SUID-root flag must be available in the system. <\/p>\n
To automatically load the rds_tcp kernel module, the exploit requests sending data via RDS using the transport SO_RDS_TRANSPORT=2. It is noted that among the tested Linux distributions, the rds kernel module is only available in the default configuration on Arch Linux. To block the vulnerability, one can prevent the auto-loading of the rds and rds_tcp kernel modules: rmmod rds_tcp rds printf 'install rds \/bin\/false\\ninstall rds_tcp \/bin\/false\\n' > \/etc\/modprobe.d\/pintheft.conf <\/p>\n
The vulnerability is caused by a bug in the implementation of the zerocopy mechanism in the function rds_message_zcopy_from_user(), which directly modifies data in the page cache to eliminate unnecessary buffering. In case of failure, the rm->data.op_nents field was not cleared, resulting in a double-free of the buffer. The emergence of an incorrect value in the reference counter could be exploited to overwrite data in the page cache by manipulating the pointer to a fixed io_uring buffer. <\/p>\n
Otherwise, the exploitation mechanism is typical for all vulnerabilities of this class \u2014 the attacker manages to place a program file with the suid root flag in the page cache, after which they substitute code into the ELF header to launch \/usr\/bin\/sh. After this manipulation, running the program results in loading not the original executable file from the storage, but a modified copy from the page cache. Unlike previous exploits, this new variant is adapted specifically for attacking the 'su' utility, but it can also be applied to other suid programs present on the system, such as mount, passwd, chsh, newgrp, umount, and pkexec. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"