{"id":181668,"date":"2026-05-23T00:25:11","date_gmt":"2026-05-22T22:25:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-23T00:25:11","modified_gmt":"2026-05-22T22:25:11","slug":"gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"GRO Frag \u2014 the seventh vulnerability in the Copy Fail class, granting root privileges in Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
An exploit for the seventh vulnerability (1, 2-3, 4, 5, 6) in the Linux kernel has been made publicly available, allowing an unprivileged local user to gain root access by overwriting data in the page cache. A CVE identifier has yet to be assigned, and aside from the exploit code, no further information about the issue is currently available. A fix is only available as a patch, which was published on May 20 and accepted into the main Linux kernel branch on May 21 (corrective kernel releases are not yet available). <\/p>\n
The vulnerability exists in the implementation of the GRO (Generic Receive Offload) technology, used to speed up the processing of segmented packets. The vulnerability is caused by an error in the implementation of the zerocopy mechanism in the skb_gro_receive() function, which directly alters data in the page cache to eliminate unnecessary buffering. When the SKBFL_MANAGED_FRAG_REFS flag is set, the reference to the released memory pages in the shinfo->frags field was skipped, leading to this field being attached to another skb without changing the reference count. This resulted in a use-after-free issue where memory was accessed after being freed. The problem could be exploited to overwrite data in the page cache by manipulating the pointer to the io_uring buffer. <\/p>\n
The attack is possible on systems with the io_uring subsystem enabled (io_uring_disabled=0). For the exploit to work, there must be a readable SUID-root executable file available on the system. The exploitation mechanism involves the attacker having the users' database settled in the page cache, after which the string \"hax::0:0::\/root:\/bin\/sh\" is injected into the cache. Following this, the command \"su hax\" is executed, which retrieves not the original users' database from the storage, but a modified copy with the fake login \"hax,\" which has root privileges and a blank password. The exploit has been tested on Ubuntu 24.04. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"