{"id":170523,"date":"2026-05-08T12:24:30","date_gmt":"2026-05-08T10:24:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux"},"modified":"2026-05-08T12:24:30","modified_gmt":"2026-05-08T10:24:30","slug":"uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux","title":{"rendered":"Dirty Frag haavatavused, mis muudavad lehe vahem\u00e4lu juurdep\u00e4\u00e4su saamiseks mis tahes Linuxi distributsioonides","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi tuumas avastati kaks haavatavust, mis on olemuselt sarnased paar p\u00e4eva tagasi avalikustatud Copy Fail haavatavusele, kuid ilmnevad teistes allhoonetes \u2014 xfrm-ESP ja RxRPC. Haavatavuste seeriale on antud koodnimi Dirty Frag (esineb ka Copy Fail 2 mainimine). Haavatavused v\u00f5imaldavad privileegideta kasutajal saada root \u00f5igused, kirjutades andmeid protsessi lehek\u00fcljekaustas. Eksploit on saadaval ja t\u00f6\u00f6tab k\u00f5ikides aktuaalsetes Linuxi distributsioonides. Teave haavatavuse kohta on avalikustatud enne paranduspatchide v\u00e4ljalaskmist, kuid on olemas m\u00f6\u00f6daviik, et probleem blokeerida. <\/p>\n

Dirty Frag h\u00f5lmab kaht erinevat haavatavust: esimene on xfrm-ESP moodulis, mida kasutatakse IPsec \u0161ifreerimise operatsioonide kiirendamiseks ESP (Encapsulating Security Payload) protokolliga, ning teine on RxRPC draiveris, mis rakendab soklite perekonda AF_RXRPC ja samanimelist RPC-protokolli, mis t\u00f6\u00f6tab UDP peal. Iga haavatavus eraldi v\u00f5imaldab saada root \u00f5igusi. Haavatavus xfrm-ESP ilmneb Linuxi tuumas alates jaanuarist 2017, samas kui RxRPC haavatavus on olemas alates juunist 2023. M\u00f5lemad probleemid on tingitud optimeerimistest, mis lubavad otse kirjutada lehek\u00fcljekausta. <\/p>\n

xfrm-ESP haavatavuse kasutamiseks peab kasutajal olema \u00f5igused nimede ruumide loomiseks, ja RxRPC haavatavuse kasutamiseks peab olema v\u00f5imalus laadida kernelimoodul rxrpc.ko. N\u00e4iteks Ubuntu's on AppArmore'i reeglites eba\u00f5igustatud kasutajatele keelatud nimede ruumide loomine, kuid vaikimisi laaditakse moodul rxrpc.ko. M\u00f5nes jaotuses puudub moodul rxrpc.ko, kuid nimede ruumide loomine ei ole blokeeritud. Probleemi avastanud teadlane valmistas ette kombineeritud eksploidi, mis suudab r\u00fcnnata s\u00fcsteemi l\u00e4bi m\u00f5lema haavatavuse, v\u00f5imaldades probleemist kasu saada k\u00f5igis peamistes jaotustes. Eksploidi t\u00f6\u00f6 on kinnitatud Ubuntu 24.04.4 versiooniga koos kerneliga 6.17.0-23, RHEL 10.1 koos kerneliga 6.12.0-124.49.1, openSUSE Tumbleweed koos kerneliga 7.0.2-1, CentOS Stream 10 koos kerneliga 6.12.0-224, AlmaLinux 10 koos kerneliga 6.12.0-124.52.3 ja Fedora 44 koos kerneliga 6.19.14-300. <\/p>\n

Nagu Copy Fail haavatavusega, on probleemi xfrm-ESP ja RxRPC puhul p\u00f5hjustatud andmete dekr\u00fcptimise teostamisest kohapeal, kasutades funktsiooni splice(), mis edastab andmeid failide descriptorite ja torude (pipe) vahel ilma kopeerimiseta, viidates elementidele lehe vahem\u00e4lus. Kirjutamise operatsiooni offset'id arvutati ilma vajalike kontrollideta, mis arvestaksid otseviidet elementidele lehe vahem\u00e4lus, mis v\u00f5imaldas saata spetsiaalselt vormindatud p\u00e4ringute kaudu \u00fcle kirjutada 4 baiti valitud offset'is ja muuta lehe vahem\u00e4lu sisu mis tahes failist. <\/p>\n

K\u00f5ik failidest lugemisoperatsioonid tagastavad esmaj\u00e4rjekorras sisu lehek\u00fcljekaustast. Andmete muutmise korral lehek\u00fcljekaustas tagavad faili lugemisoperatsioonid mitte reaalselt salvestatud teabe, vaid asendatud andmed. Haavatavuse \u00e4rakasutamine seisneb lehek\u00fcljekausta muutmises, et k\u00e4ivitatav fail, millel on suid root lipp. N\u00e4iteks v\u00f5ivad root \u00f5iguste saamiseks lugeda k\u00e4ivitatavat faili \/usr\/bin\/su, et see paigutada lehek\u00fcljekausta, mille j\u00e4rel saab asendada oma koodi lehek\u00fcljekausta laetud faili sisuga. J\u00e4rgneva 'su' utiliidi k\u00e4ivitamine toob m\u00e4llu mitte originaalse k\u00e4ivitatava faili salvestusest, vaid muudetud koopia lehek\u00fcljekaustast. <\/p>\n

Haavatavuste teabe avalikustamine ja koordineeritud v\u00e4rskenduste v\u00e4ljalaskmine oli planeeritud 12. maiks, kuid teabe lekkimise t\u00f5ttu tuli haavatavuse andmed avalikustada enne parandusfailide v\u00e4ljaandmist. Aprilli l\u00f5pus avaldati netdevi avalikus postitusloendis rxrpc, ipsec ja xfrm patchid, ilma et oleks mainitud, et need on seotud haavatavuse k\u00f5rvaldamisega. 5. mail n\u00f5ustus IPsec alams\u00fcsteemi hooldaja netdevi git-repositooriumis xfrm-esp mooduli parandusettepanekuga, mille kirjeldus kordas suuresti probleemi, mis viis Copy Fail haavatavuse tekkimiseni algif_aead moodulis. \u00dcks turva-uuringute teostaja oli selle paranduse vastu huvi tunnenud, suutis luua funktsionaalse eksploidimise ja avaldas selle, teadmata, et probleemi kohta teabe avalikustamine oli 12. maieni keelatud. <\/p>\n

Linuxi tuuma ja tuuma pakettide parandustega uuendusi ei ole veel avaldatud, kuid probleemide lahendamise pat\u0161id \u2014 xfrm-esp ja rxrpc \u2014 on saadaval. CVE-id ei ole m\u00e4\u00e4ratud, mis raskendab pakettide uuenduste j\u00e4lgimist distributsioonides. Kaitsmiseks v\u00f5ib kasutada m\u00f6\u00f6daviiku, et blokeerida esp4, esp6 ja rxrpc tuumamoodulite laadimine: sh -c 'printf 'install esp4 \/bin\/false\ninstall esp6 \/bin\/false\ninstall rxrpc \/bin\/false\n' > \/etc\/modprobe.d\/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>\/dev\/null; true
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u0443\u0442\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail, \u043d\u043e \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 — xfrm-ESP \u0438 RxRPC. \u0421\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Dirty Frag (\u0442\u0430\u043a\u0436\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 Copy Fail 2). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170523","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused Dirty Frag, mis muudavad lehevahemikku root \u00f5iguste saamiseks igas Linuxi distributsioonis | ProHoster","description":"Linuxi tuumas on tuvastatud kaks haavatavust, mis on olemuselt sarnased paar p\u00e4eva tagasi avalikustatud Copy Fail haavatavusele, kuid esinevad teistes alams\u00fcsteemides - xfrm-ESP ja RxRPC. Haavatavuste seeriale on antud koodnimi Dirty Frag (esineb ka mainimist Copy Fail 2). Haavatavused v\u00f5imaldavad privileegideta kasutajal saada root \u00f5igused, kirjutades andmeid protsessi lehevahemikus \u00fcle. Eksploit on saadaval, mis t\u00f6\u00f6tab","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Dirty Frag, \u0438\u0437\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043a\u044d\u0448 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root \u0432 \u043b\u044e\u0431\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u0443\u0442\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail, \u043d\u043e \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 - xfrm-ESP \u0438 RxRPC. \u0421\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Dirty Frag (\u0442\u0430\u043a\u0436\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 Copy Fail 2). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-08T10:24:30+00:00","article:modified_time":"2026-05-08T10:24:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/170523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=170523"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/170523\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=170523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=170523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=170523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}