{"id":170701,"date":"2026-05-15T12:24:29","date_gmt":"2026-05-15T10:24:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha"},"modified":"2026-05-15T12:24:29","modified_gmt":"2026-05-15T10:24:29","slug":"fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha","title":{"rendered":"Fragnesia \u2014 haavatavus Linuxi tuumas, mis v\u00f5imaldab root-juurdep\u00e4\u00e4su l\u00e4bi lehe vahem\u00e4lu muutmise.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi tuumas tuvastati neljas haavatavus kahe n\u00e4dala jooksul (CVE-2026-46300), mis v\u00f5imaldab tavakasutajal saada root-\u00f5igusi, kirjutades andmeid lehe vahem\u00e4llu. Haavatavusele on antud koodnimi Fragnesia v\u00f5i Copy Fail 3.0. Haavatavuse olemus on sarnane varasemate Copy Fail ja Dirty Frag haavatavustega. Nagu ka Dirty Frag'i puhul, esineb uus haavatavus xfrm-ESP alams\u00fcsteemis, kuid on p\u00f5hjustatud teisest veast ja vajab eraldi parandust. T\u00f6\u00f6korras eksploit on saadaval. <\/p>\n

Haavatavus avaldub Linuxi tuumades, mis on v\u00e4lja antud p\u00e4rast 5. mai, vigastuse Dirty Frag parandamise juhusliku aktiveerimise t\u00f5ttu. Fragnesia haavatavuse k\u00f5rvaldamiseks on Linuxi tuuma jaoks v\u00e4lja pakutud parandused. Antud paranduse anal\u00fc\u00fcs n\u00e4itas, et see ei ole piisav, p\u00e4rast mida valmistati ette teine versioon pat\u0161ist. <\/p>\n

Haavatavus esineb xfrm alams\u00fcsteemis, mis rakendab ESP (Encapsulating Security Payload) protokolli kapseldamise mehhanismi TCP-s (ESP-in-TCP, RFC 8229), mida kasutatakse IPsec liikluse tunnelimiseks TCP kohal. \u00dcksikute AES-GCM algoritmiga teostatavate toimingute jaoks v\u00e4ltimiseks eraldi puhverserveri rakendati operatsioone otse, tehes XOR-operatsiooni andmetega lehe vahem\u00e4lus. Loogilise vea t\u00f5ttu tekkisid tingimused, mis v\u00f5imaldasid kirjutada 1 bait lehe vahem\u00e4lu valitud nihkes. Korrates toimingut on v\u00f5imalik bait-baidi haaval muuta mis tahes faili sisu lehe vahem\u00e4lus. <\/p>\n

K\u00f5ik faili lugemisoperatsioonid tagastavad esmalt sisu lehe vahem\u00e4lust. Andmete muutmise korral lehe vahem\u00e4lus toovad faili lugemisoperatsioonid tagasi mitte tegelikult salvestatud teabe, vaid muudetud andmed. Haavatavuse ekspluateerimine h\u00f5lmab lehe vahem\u00e4lu muutmist root \u00f5igustega suid lipuga t\u00e4idetud k\u00e4ivitatava faili jaoks, mis on eelnevalt loetud lehe vahem\u00e4lu sisse. Uuringutegijate pakutud eksploitv kodu esimene 192 baiti faili \/usr\/bin\/su lehe vahem\u00e4lu kirjutatakse \u00fcle koodiga, et k\u00e4ivitada \/usr\/bin\/sh. J\u00e4rgmine utiliidi 'su' k\u00e4ivitamine toob kaasa selle, et m\u00e4llu laaditakse mitte originaalne faili seadistus, vaid muudetud koopia lehe vahem\u00e4lust. <\/p>\n

\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Fragnesia \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0451\u043d \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (user namespace). \u0412 Ubuntu \u043f\u043e\u0434\u043e\u0431\u043d\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u0430, \u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 sysctl «kernel.apparmor_restrict_unprivileged_userns=0» \u0438\u043b\u0438 \u043f\u0440\u043e\u0444\u0438\u043b\u0438 AppArmor. \u0412 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c «user namespace» \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f sysctl «kernel.unprivileged_userns_clone» (\u0435\u0441\u043b\u0438 0, \u0442\u043e \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043e). <\/p>\n

Kerneli Linuxi ja kerneli pakettide parandustega v\u00e4rskendusi distributsioonides ei ole praegu avaldatud. Haavatavuste k\u00f5rvaldamise staatust distributsioonides saab hinnata j\u00e4rgmiste lehtede p\u00f5hjal: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Gentoo, Arch, Fedora. Kaitse m\u00f6\u00f6daviigu lahendusena saab keelata kerneli moodulite esp4 ja esp6 laadimise: <\/p>\n

sh -c «printf ‘install esp4 \/bin\/false\ninstall esp6 \/bin\/false\n’ > \/etc\/modprobe.d\/dirtyfrag.conf; rmmod esp4 esp6 2>\/dev\/null; true»
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0434\u0432\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-46300), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Fragnesia \u0438\u043b\u0438 Copy Fail 3.0. \u0421\u0443\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430 \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c Copy Fail \u0438 Dirty Frag. \u041a\u0430\u043a \u0438 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 Dirty Frag \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 xfrm-ESP, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170701","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Fragnesia \u2014 haavatavus Linuxi tuumas, mis v\u00f5imaldab saada root \u00f5igusi lehe vahem\u00e4lu muutmise kaudu | ProHoster","description":"Linuxi tuumas avastati neljas haavatavus viimase kahe n\u00e4dala jooksul (CVE-2026-46300), mis v\u00f5imaldab mittekinnitatud kasutajal saada root \u00f5igusi, kirjutades andmeid lehe vahem\u00e4lu. Haavatavusele on antud koodinimi Fragnesia v\u00f5i Copy Fail 3.0. Haavatavuse olemus on sarnane varasematele Copy Fail ja Dirty Frag haavatavustele. Nagu Dirty Frag puhul, on ka uus haavatavus olemas xfrm-ESP alam-s\u00fcsteemis.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Fragnesia \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root \u0447\u0435\u0440\u0435\u0437 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u0433\u043e \u043a\u044d\u0448\u0430 | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0434\u0432\u0435 \u043d\u0435\u0434\u0435\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-46300), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Fragnesia \u0438\u043b\u0438 Copy Fail 3.0. \u0421\u0443\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430 \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c Copy Fail \u0438 Dirty Frag. \u041a\u0430\u043a \u0438 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 Dirty Frag \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 xfrm-ESP,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-15T10:24:29+00:00","article:modified_time":"2026-05-15T10:24:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/170701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=170701"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/170701\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=170701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=170701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=170701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}