{"id":181666,"date":"2026-05-22T18:25:08","date_gmt":"2026-05-22T16:25:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti"},"modified":"2026-05-22T18:25:08","modified_gmt":"2026-05-22T16:25:08","slug":"iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","title":{"rendered":"Linuxista poistetaan AF_ALG:sta zero-copy turvallisuussyist\u00e4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi kr\u00fcptograafia alams\u00fcsteemis on plaanis toetuse eemaldamine zero-copy<\/strong> liidestest AF_ALG<\/strong> algoritmide t\u00fc\u00fcpide jaoks SKCIPHER<\/strong> ja AEAD<\/strong>. Muudatus on juba cryptodevi puus ja ootab edastamist sulandumise aknasse Linux 7.2<\/strong>, mis peaks avanema juunis. Selle p\u00f5hjuseks on kasvavad mured zero-copy mehhanismide turvalisuse \u00fcle, eriti p\u00e4rast hiljutisi haavatavusi Linuxi kr\u00fcptograafia koodis.<\/p>\n

<\/p>\n

AF_ALG<\/strong> \u2014 see on kasutajaliides<\/a> Linuxi tuumkr\u00fcptograafia API-le. Selle kaudu saavad programmid juurdep\u00e4\u00e4su tuumdes paiknevatele kr\u00fcpteerimis-, hashimis- ja AEAD-algoritmide rakendustele, nagu soketid. Linuxi dokumentatsioon kirjeldab eraldi AF_ALG zero-copy re\u017eiimi splice() ja vmsplice() kaudu, mille korral tuum p\u00fc\u00fcab v\u00e4ltida andmete \u00fclem\u00e4\u00e4rast kopeerimist tuumam\u00e4llu.<\/p>\n

<\/noindex><\/noindex><\/p>\n

<\/p>\n

Probleem on selles, et AF_ALG korral ei olnud see j\u00f5udluse kasu nii oluline ja riskid liiga suured. Muudatuse autor, Linuxi kr\u00fcptograafia alams\u00fcsteemi arendaja Eric Biggers Google\u2019ist, et<\/a>, et zero-copy v\u00f5imaldab kasutajaruumi kr\u00fcptograafilisi operatsioone otse page cache failide lehtedel, nagu n\u00e4iteks binaarfail su, ning loob tingimused TOCTOU-t\u00fc\u00fcpi haavatavustele, kus m\u00e4lu v\u00f5ib muutuda samal ajal, kui selle \u00fcle operatsiooni tehakse.<\/p>\n

<\/noindex><\/p>\n

Teisis\u00f5nu, mehanism, mis on kasulik v\u00f5rgus v\u00f5i failide sisend-v\u00e4ljundis, n\u00e4eb AF_ALG-is v\u00e4lja nagu liiga ohtlik optimeerimine. AF_ALG-i ise, arendaja s\u00f5nul, hoitakse praegu enamasti tagasi\u00fchilduvuse nimel, et toetada v\u00e4ikest hulka programme, nagu iwd, mis ei ole veel kasutajaruumi kr\u00fcptograafiale \u00fcle l\u00e4inud. Alguses oli AF_ALG m\u00f5eldud ka riistvara kr\u00fcptokiirendite access'i jaoks, kuid praktikas on see osutunud selle \u00fclesande jaoks mitte liiga efektiivseks liideseks.<\/p>\n

Oluline on m\u00e4rkida, et see ei t\u00e4henda splice() v\u00f5i sendfile() t\u00e4ielikku eemaldamist AF_ALG jaoks. Muudatus on kirjeldatud kui 'pehme rikete' \u00fchilduvus: andmete edastamine AF_ALG-p\u00e4ringutes splice() ja sendfile() kaudu j\u00e4tkab toimimist, kuid tuuma n\u00fc\u00fcd teeb enne kr\u00fcptograafilist operatsiooni sisemise stabiilse koopia andmetest. M\u00f5nel juhul v\u00f5ib j\u00f5udlus v\u00e4heneda, kuid kasutaja API ei purune ametlikult.<\/p>\n

Erakordselt r\u00f5hutatakse, et zero-copy eemaldatakse skcipher<\/strong> ja aead<\/strong>. T\u00fc\u00fcpide tugi hash<\/strong> kaalutakse eraldi.<\/p>\n

<\/p>\n

Muudatuse kontekst on ebameeldiv. Aprilli l\u00f5pus ilmus haavatavus Copy Fail<\/a><\/strong> (CVE-2026-31431<\/strong>) algif_aead'i, mis on just kasutaja kr\u00fcpto liidese AF_ALG osa. Uurijad n\u00e4itasid, et AF_ALG, splice() ja AEAD-t\u00f6\u00f6tlemise omaduste kombinatsioon v\u00f5imaldas madala privileegiga kasutajal kahjustada page cache'i, sealhulgas andmeid, mis vastavad setuid-binaaridele, ning saada root-privileegide t\u00f5us.<\/p>\n

<\/noindex>
\n<\/p>\n

Ilmumine Copy Fail<\/a> oli seotud 2017. aasta optimeerimisega, mis viis AEAD-operations'i t\u00f6\u00f6tlemise \"kohapeal\"; faili edastamisel splice() kaudu t\u00f6\u00f6tas AF_ALG s\u00fcdamik mitte koopia, vaid lehtede page cache viidetes. Selle tulemusena v\u00f5is osa andmetest, mis olid arvatud vaid sisenditeks, sattuda kirjutatavasse scatterlist'i.<\/p>\n

<\/noindex><\/p>\n

Zero-copy eemaldamine AF_ALG ei ole pelgalt \u00fche haavatavuse parandamine. Pigem on see katses k\u00f5rvaldada terve klass riskantseid stsenaariume, mis esinevad v\u00e4hekasutatavas UAPI-s, kus optimeerimisest saadav kasu ei \u00f5igusta keerukust ja v\u00f5imalikke tagaj\u00e4rgi. Tavalistele kasutajatele j\u00e4\u00e4b muudatus t\u00f5en\u00e4oliselt m\u00e4rkamatuks; harvade programmide jaoks, mis aktiivselt kasutavad AF_ALG-i l\u00e4bi splice() v\u00f5i sendfile(), v\u00f5ib esineda j\u00f5udluse langust t\u00e4iendava kopeerimise t\u00f5ttu.<\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0443\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 cryptodev \u0438 \u043e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f \u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0432 \u043e\u043a\u043d\u043e \u0441\u043b\u0438\u044f\u043d\u0438\u044f Linux 7.2, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c\u0441\u044f \u0432 \u0438\u044e\u043d\u0435. \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0441\u0442\u0430\u043b\u0438 \u0440\u0430\u0441\u0442\u0443\u0449\u0438\u0435 \u043e\u043f\u0430\u0441\u0435\u043d\u0438\u044f \u0432\u043e\u043a\u0440\u0443\u0433 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 zero-copy-\u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0432 \u044f\u0434\u0440\u0435, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u0434\u0435 Linux. AF_ALG […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181666","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47AF_ALG'is Linuxis eemaldatakse zero-copy turvakaalutlustel | ProHoster","description":"Linuxi kr\u00fcptograafia alasts\u00fcsteemis valmistatakse ette zero-copy toe eemaldamist AF_ALG liidest SKCIPHER ja AEAD algoritmide t\u00fc\u00fcpide jaoks. Muudatus on juba cryptodev puus ja oodatakse, et see saadetakse Linux 7.2 sulandumise aknasse, mis peaks avanema juunis. P\u00f5hjuseks on suurenev mure zero-copy mehhanismide turvalisuse \u00fcle kernelis, eriti p\u00e4rast hiljutisi haavatavusi Linuxi kr\u00fcptograafilises koodis. AF_ALG","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437 AF_ALG \u0432 Linux \u0443\u0431\u0438\u0440\u0430\u044e\u0442 zero-copy \u0438\u0437 \u0441\u043e\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0443\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 cryptodev \u0438 \u043e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f \u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0432 \u043e\u043a\u043d\u043e \u0441\u043b\u0438\u044f\u043d\u0438\u044f Linux 7.2, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c\u0441\u044f \u0432 \u0438\u044e\u043d\u0435. \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0441\u0442\u0430\u043b\u0438 \u0440\u0430\u0441\u0442\u0443\u0449\u0438\u0435 \u043e\u043f\u0430\u0441\u0435\u043d\u0438\u044f \u0432\u043e\u043a\u0440\u0443\u0433 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 zero-copy-\u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0432 \u044f\u0434\u0440\u0435, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u0434\u0435 Linux. AF_ALG","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-22T16:25:08+00:00","article:modified_time":"2026-05-22T16:25:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=181666"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181666\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=181666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=181666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=181666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}