{"id":181666,"date":"2026-05-22T18:25:08","date_gmt":"2026-05-22T16:25:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti"},"modified":"2026-05-22T18:25:08","modified_gmt":"2026-05-22T16:25:08","slug":"iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","title":{"rendered":"AF_ALG'is Linuxis eemaldatakse zero-copy turvakaalutluste t\u00f5ttu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Linuxi kr\u00fcptograafia alams\u00fcsteemis valmistatakse ette tugiteenuse eemaldamist zero-copy<\/strong> liidesest AF_ALG<\/strong> algoritmi t\u00fc\u00fcpide jaoks SKCIPHER<\/strong> ja AEAD<\/strong>. Muudatus on juba cryptodevi puu sees ja ootab sulandumise aknas saatmist Linux 7.2<\/strong>, mis peaks avanema juunis. P\u00f5hjuseks on mure zero-copy mehhanismide turvalisuse \u00fcle kernis, eriti p\u00e4rast hiljutisi haavatavusi Linuxi kr\u00fcptograafilises koodis.<\/p>\n

<\/p>\n

AF_ALG<\/strong> \u2014 see on kasutajaliides<\/a> Linuxi kr\u00fcptograafia API-le. Selle kaudu saavad programmid p\u00f6\u00f6rduda kr\u00fcptograafiliste algoritmide, hash\u2019ide ja AEAD-algoritmide teostuste poole kernis nagu soketite poole. Linuxi dokumentatsioon kirjeldab eraldi AF_ALG zero-copy re\u017eiimi l\u00e4bi splice() ja vmsplice(), mille k\u00e4igus p\u00fc\u00fcab kern v\u00e4ltida tarbetut andmete kopeerimist kerni m\u00e4llu.<\/p>\n

<\/noindex><\/noindex><\/p>\n

<\/p>\n

Probleem on selles, et AF_ALG puhul ei osutunud see j\u00f5udluse kasu nii m\u00e4rkimisv\u00e4\u00e4rseks ja riskid on liiga suured. Muudatuse autor, Linuxi kr\u00fcptograafia alams\u00fcsteemi arendaja Erik Biggers Google'ist, mainis<\/a>, et zero-copy v\u00f5imaldab kasutajaruumi k\u00e4ivitada kr\u00fcptograafilisi toiminguid otse failide page cache'i lehtedel, n\u00e4iteks binaarfailis su, ja loob tingimused TOCTOU-haavatavustele, kus m\u00e4lu v\u00f5ib samal ajal muutuda toimingu k\u00e4igus.<\/p>\n

<\/noindex><\/p>\n

Teisis\u00f5nu, mehhanism, mis on kasulik v\u00f5rgus v\u00f5i failide sisendi-v\u00e4ljundi puhul, n\u00e4eb AF_ALG-is v\u00e4lja liiga ohtliku optimeerimisena. Ise AF_ALG, arendaja s\u00f5nul, s\u00e4ilitakse praegu peamiselt tagurpidi \u00fchilduvuse nimel v\u00e4ikese programmide kogumi jaoks, n\u00e4iteks iwd, mis pole veel \u00fcleviidud kasutajaruumi kr\u00fcptograafiale. Alguses oli AF_ALG m\u00f5eldud ka riistvaraliste kr\u00fcptokiirendite juurde p\u00e4\u00e4semiseks, kuid praktikas osutus see selle \u00fclesande jaoks mitte eriti t\u00f5husaks liideseks.<\/p>\n

Oluline on m\u00e4rkida, et tegemist ei ole splice() v\u00f5i sendfile() t\u00e4ieliku eemaldamisega AF_ALG jaoks. Muudatus kirjeldatakse kui \u201epehme rike\u201c \u00fchilduvuses: andmete edastamine AF_ALG p\u00e4ringutesse splice() ja sendfile() kaudu j\u00e4tkab t\u00f6\u00f6tamist, kuid kern teeb n\u00fc\u00fcd kr\u00fcptograafilise toimingu eel stabiilse sisemise koopia andmetest. J\u00f5udlus v\u00f5ib m\u00f5nel juhul v\u00e4heneda, kuid kasutaja API ei purune formaalselt.<\/p>\n

Erinevalt r\u00f5hutatakse, et praegu eemaldatakse zero-copy skcipher<\/strong> ja aead<\/strong>. T\u00fc\u00fcbi toetamine hash<\/strong> arutatakse eraldi.<\/p>\n

<\/p>\n

Muudatus toimub ebasoodsates oludes. Aprilli l\u00f5pus paljastati haavatavus Kopeeri nurjumine<\/a><\/strong> (CVE-2026-31431<\/strong>) algif_aead, mis t\u00e4hendab, et see on t\u00e4pselt kasutaja kr\u00fcptoliidese AF_ALG osas. Uurijad n\u00e4itasid, et AF_ALG, splice() ja AEAD-t\u00f6\u00f6tluse omaduste kombinatsioon v\u00f5imaldas mitteprivilegeeritud kasutajal kahjustada page cache'i, sealhulgas lehti, mis vastavad setuid-binaaridele, ning saada juurkontrolli \u00f5iguseid.<\/p>\n

<\/noindex>
\n<\/p>\n

Ilmumine Kopeeri nurjumine<\/a> oli seotud 2017. aasta optimeerimisega, mis viis AEAD-operatsioonid \u201ekohtade peal\u201c t\u00f6\u00f6tlemisse; failide edastamisel splice() kaudu AF_ALG-i, t\u00f6\u00f6tles kerneli mitte koopia, vaid lingid page cache'i lehtedele. Selle tulemusena v\u00f5ivad osa andmetest, mida peeti ainult sisenditeks, ilmuda kirjutatavas scatterlist'is.<\/p>\n

<\/noindex><\/p>\n

Zero-copy eemaldamine AF_ALG-ist ei ole punktikohane parandus ainult \u00fche haavatavuse jaoks. Pigem on see katse k\u00f5rvaldada terve riskantsete stsenaariumite klass v\u00e4hekasutatavas UAPI-s, kus optimeerimisest saadav kasu ei \u00f5igusta keerukust ja potentsiaalseid tagaj\u00e4rgi. Tavalistele kasutajatele j\u00e4\u00e4b see muutus t\u00f5en\u00e4oliselt m\u00e4rkamatuks; haruldaste programmide puhul, mis kasutavad AF_ALG-i aktiivselt l\u00e4bi splice() v\u00f5i sendfile(), v\u00f5ib tekkida j\u00f5udluse langus t\u00e4iendava kopeerimise t\u00f5ttu.<\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0443\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 cryptodev \u0438 \u043e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f \u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0432 \u043e\u043a\u043d\u043e \u0441\u043b\u0438\u044f\u043d\u0438\u044f Linux 7.2, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c\u0441\u044f \u0432 \u0438\u044e\u043d\u0435. \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0441\u0442\u0430\u043b\u0438 \u0440\u0430\u0441\u0442\u0443\u0449\u0438\u0435 \u043e\u043f\u0430\u0441\u0435\u043d\u0438\u044f \u0432\u043e\u043a\u0440\u0443\u0433 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 zero-copy-\u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0432 \u044f\u0434\u0440\u0435, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u0434\u0435 Linux. AF_ALG […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181666","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47AF_ALG-ist Linuxis eemaldatakse zero-copy turvakaalutlustel | ProHoster","description":"Linuxi kr\u00fcptos\u00fcsteemis valmistatakse ette zero-copy toe eemaldamist AF_ALG liidesest SKCIPHER ja AEAD algoritmide t\u00fc\u00fcpide jaoks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437 AF_ALG \u0432 Linux \u0443\u0431\u0438\u0440\u0430\u044e\u0442 zero-copy \u0438\u0437 \u0441\u043e\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-22T16:25:08+00:00","article:modified_time":"2026-05-22T16:25:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=181666"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181666\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=181666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=181666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=181666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}