{"id":172668,"date":"2026-05-19T06:24:52","date_gmt":"2026-05-19T04:24:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly"},"modified":"2026-05-19T12:52:18","modified_gmt":"2026-05-19T10:52:18","slug":"v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","title":{"rendered":"Linuxis on suletud ssh-keysign-pwn haavatavus, mis v\u00f5imaldab kohalikul kasutajal lugeda root-faile.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi tuumas parandati haavatavus, millele anti mitteametlik nimi ssh-keysign-pwn<\/strong>. Probleem v\u00f5imaldab kohalikul madala privileegiga kasutajal lugeda faile, mis peaksid olema saadaval ainult root'ile, sealhulgas privaatseid SSH host-v\u00f5tmeid ja teatud stsenaariumides \/etc\/shadow. Publikatsiooni hetkel polnud probleemile eraldi CVE veel m\u00e4\u00e4ratud.<\/p>\n

<\/p>\n

Hoolimata nimest ei ole tegu veaga OpenSSH-s kui v\u00f5rguteenuses sshd, vaid defektiga<\/a> Linuxi tuuma loogikas, mis on seotud ptrace'i kontrollide ja juurdep\u00e4\u00e4suga teise protsessi failidesse l\u00e4bi pidfd_getfd(2). OpenSSH utiliit ssh-keysign osutus \u00fcheks mugavaks ekspluateerimise n\u00e4iteks, kuna see t\u00f6\u00f6tab privaatsete host-v\u00f5tmetega, mis tavaliselt kuuluvad root'ile ja ei ole tavalistele kasutajatele k\u00e4ttesaadavad.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Veateadete olemus<\/a> on see, et funktsioon __ptrace_may_access() t\u00f6\u00f6tas vale protsessiseisundiga, millel oli juba kadunud m\u00e4lu struktuur mm, kuid avatud failide descriptorid j\u00e4id samas alles. Protsessi l\u00f5petamise ajal kutsub tuum v\u00e4lja exit_mm() enne failide sulgemist exit_files() kaudu. Selle l\u00fchikese ajavahemiku jooksul n\u00e4eb protsess v\u00e4lja nagu tal puuduks tavaline kasutaja aadressiruum, kuid avatud failid eksisteerivad endiselt. Seet\u00f5ttu v\u00f5ib \u00abdumpable\u00bb-seisundi kontroll j\u00e4etuks ning pidfd_getfd() v\u00f5ib saada juurdep\u00e4\u00e4su teise failide deskriptorile vastava UID-ga.<\/p>\n

<\/noindex> <\/p>\n

Praktiline stsenaarium keskendub setuid-programmidele, mis avavad esmalt tundliku faili root-\u00f5igustega, seej\u00e4rel t\u00fchistavad \u00f5igused ja l\u00f5petavad, omades endiselt avatud deskriptorit. Avaldatud kirjelduses on n\u00e4iteks toodud ssh-keysign: see avab \/etc\/ssh\/ssh_host_{ecdsa,ed25519,rsa}_key, p\u00e4rast mida t\u00fchistab \u00f5igused ja v\u00f5ib l\u00f5petada, kui EnableSSHKeysign on v\u00e4lja l\u00fclitatud. Need v\u00f5tmed peaksid olema k\u00e4ttesaadavad ainult root'ile, kuna neid kasutatakse host-p\u00f5histes autentimistes.<\/p>\n

Teine n\u00e4ide on chage, mis v\u00f5ib avada \/etc\/shadow, seej\u00e4rel t\u00fchistada efektiivsed \u00f5igused ja l\u00f5petada. Seet\u00f5ttu ei t\u00e4henda r\u00fcnnak tingimata kohe root-\u00f5igustega shelli saamist, kuid see v\u00f5imaldab saada failide sisu, mida tavaliselt peetakse kriitiliselt privaatseks. \/etc\/shadow lekke oht on v\u00f5imalus j\u00e4rgnevalt l\u00e4bi viia offline-paroolide proovimist, samas kui privaatsete SSH host-v\u00f5tmete lekke risk on hosti petmine v\u00f5i usaldusv\u00e4\u00e4rsete SSH-stsenaariumide r\u00fcnnak.<\/p>\n

Parandused on juba tehtud p\u00f5hiv\u00f5rku Linux. Kommit 31e62c2ebbfd pealkirjaga ptrace: slightly saner 'get_dumpable()' loogika muudab dumpability kontrollimise k\u00e4itumist: kern salvestab n\u00fc\u00fcd user_dumpable seisundi mm kadumisel ja n\u00f5uab CAP_SYS_PTRACE korrektset kontrollimist \u00fcmbers\u00f5iduks. Patch m\u00f5jutab include\/linux\/sched.h, kernel\/exit.c ja kernel\/ptrace.c.<\/p>\n

Vulnerabiliteet teatati Qualys'ile ja selle parandas Linus Torvalds 14. mail 2026. Phoronix m\u00e4rgib, et probleemi avalikustamise ajal m\u00f5jutas see k\u00f5iki Linuxi kernel versioone kuni hetke mainline-puu seisuni enne paranduse tegemist. PoC autor m\u00e4rgib ka, et haavatavad on kernelid kuni commit 31e62c2ebbfd, sealhulgas stabiilsed harud 14. mai seisuga.<\/p>\n

<\/p>\n

Eraldi oluline on, et ekspluateerimiseks ei ole vaja laadida spetsiifilisi kernelimooduleid, nagu m\u00f5nede viimaste LPE haavatavuste puhul. Piisab kohalikust privileegita juurdep\u00e4\u00e4sust s\u00fcsteemile ja sobiva privileegiga abiprotsessi olemasolust. Debian'i arendaja Daniel Baumann operatsioonide<\/a>, et see probleem tuleks lahendada kernel'i uuendamise ja sellele j\u00e4rgneva k\u00e4ivitamisega parandatud kernel'isse.<\/p>\n

<\/noindex> <\/p>\n

Avaldatud repo demonstreerib kontrolli Raspberry Pi OS Bookworm'i kernel'i 6.12.75, Debian 13, Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04, Arch ja CentOS 9. Sellele nimekirjale tuleks l\u00e4heneda autori PoC andmetena, mitte kui ammendavale loetelule: kuna viga on \u00fcldises kernel'i loogikas, s\u00f5ltub tegelik katvus kernel'i versioonist ja konkreetsest distributsioonist saadaval olevast backport-parandamisest.<\/p>\n

Administraatoreid puudutav peamine soovitus on lihtne: installige oma distributsioonilt uuendatud kernel'i pakett ja taask\u00e4ivitage s\u00fcsteem. Kui on olemas alust arvata, et masinasse on juba sisenenud kohalik privileegita juurdep\u00e4\u00e4s, tuleks p\u00e4rast uuendust kaaluda SSH host-v\u00f5ti keeramist ja \/etc\/shadow\/ kasutajakontode kontrollimist, kuna haavatavus on seotud tundlike failide lugemisega, mitte ainult abstraktse juurdep\u00e4\u00e4sukontrolli \u00fcletamisega.<\/p>\n

Debian'is on juba alustatud paranduse viimist: Baumann teatas upstream-commiti cherry-pick'ist trixie-fastforward-backports'i ning merge request'i saatmisest Debian sid'i. Merge request'is on selgelt m\u00e4rgitud, et kantakse \u00fcle commit 31e62c2 dumpability ptrace-loogika parandamiseks, mis v\u00f5imaldab privileegita kasutajal lugeda root-failide sisu.<\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0447\u0438\u0442\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e root, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 SSH host-\u043a\u043b\u044e\u0447\u0438 \u0438, \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445, \/etc\/shadow. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 CVE \u0434\u043b\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0435\u0449\u0451 \u043d\u0435 \u0431\u044b\u043b \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d. \u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435, \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043d\u0435 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 OpenSSH \u043a\u0430\u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172668","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Linuxis on suletud haavatavus ssh-keysign-pwn, mis v\u00f5imaldab kohalikel kasutajatel lugeda root-failide sisu | ProHoster","description":"Linuxi tuumas on parandatud haavatavus, mille mitteformaalseks nimetuseks on ssh-keysign-pwn.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c ssh-keysign-pwn, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0447\u0438\u0442\u0430\u0442\u044c root-\u0444\u0430\u0439\u043b\u044b | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-19T04:24:52+00:00","article:modified_time":"2026-05-19T10:52:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/172668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=172668"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/172668\/revisions"}],"predecessor-version":[{"id":172737,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/172668\/revisions\/172737"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=172668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=172668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=172668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}