{"id":181668,"date":"2026-05-23T00:25:11","date_gmt":"2026-05-22T22:25:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-23T00:25:11","modified_gmt":"2026-05-22T22:25:11","slug":"gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"GRO Frag — seitsmes Copy Fail klassi haavatavus, mis annab root \u00f5igused Linuxis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avalikult on saadaval eksploitee seitsmendale haavatavusele (1, 2-3, 4, 5, 6) Linuxi tuumas, mis v\u00f5imaldab mitteprivileegitud lokaalsel kasutajal saada root \u00f5igused, salvestades andmeid lehepuuduses. CVE identifikaator pole veel m\u00e4\u00e4ratud, v\u00e4ljaspool eksploiteerimiskoodi ei ole probleemi kohta veel teavet. Parandus on saadaval ainult pat\u0161ina, mis avaldati 20. mail ja 21. mail v\u00f5eti see Linuxi tuuma peavoolu (korrektiivsed tuuma v\u00e4ljastused pole veel saadaval). <\/p>\n

Haavatavus esineb GRO (Generic Receive Offload) tehnoloogia rakenduses, mida kasutatakse segmenteeritud andmepakettide t\u00f6\u00f6tlemise kiirendamiseks. Haavatavus tuleneb vea t\u00f5ttu zerocopy mehhanismi rakenduses funktsioonis skb_gro_receive(), mis muudab otse andmeid lehe vahem\u00e4less, et v\u00e4ltida liigset puhverserveri kasutamist. Kui SKBFL_MANAGED_FRAG_REFS lipp oli seatud, j\u00e4eti m\u00e4lu vabastatavate lehtede viite salvestamine v\u00e4lja shinfo->frags alanurgas, mille j\u00e4rel liideti see ala teise skb-ga ilma viite loenduri muutmata, mis viis m\u00e4lule j\u00e4rgnevale juurdep\u00e4\u00e4sule p\u00e4rast vabastamist (use-after-free). Probleemi \u00f5nnestus \u00e4ra kasutada, et kirjutada andmeid lehe vahem\u00e4ledes, manipuleerides io_uring'i puhverserveri viidaga. <\/p>\n

R\u00fcnnak on v\u00f5imalik s\u00fcsteemides, kus on sisse l\u00fclitatud io_uring alams\u00fcsteem (io_uring_disabled=0). Eksploiti toimimiseks peab s\u00fcsteemis olema lugemiseks saadaval SUID-root lipuga t\u00e4idetav fail. Eksploiteerimise mehhanism seisneb selles, et r\u00fcndaja saavutab kasutajateiba salvestamise lehe vahem\u00e4llu, p\u00e4rast mida asendab ta vahem\u00e4lus oleva stringi 'hax::0:0::\/root:\/bin\/sh'. J\u00e4rgmisena k\u00e4ivitub k\u00e4sk 'su hax', mis ei saa mitte originaalset kasutajateiba m\u00e4lust, vaid muudetud koopia, kus on vale sisselogimisega 'hax', kellel on m\u00e4\u00e4ratud root \u00f5igused ja t\u00fchi parool. Eksploiti on testitud Ubuntu 24.04-s.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0441\u0435\u0434\u044c\u043c\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (1, 2-3, 4, 5, 6) \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0435\u0449\u0451 \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d, \u043a\u0440\u043e\u043c\u0435 \u043a\u043e\u0434\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u043a\u0430 \u043d\u0435\u0442. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d 20 \u043c\u0430\u044f \u0438 21 \u043c\u0430\u044f \u0431\u044b\u043b \u043f\u0440\u0438\u043d\u044f\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181668","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GRO Frag \u2014 seitsmes Copy Fail klassi haavatavus, mis annab Linuxis root-\u00f5igused | ProHoster","description":"Avalikult on saadaval eksploitt seitsmendale haavatavusele (1, 2-3, 4, 5, 6) Linuxi tuumas, mis v\u00f5imaldab privileegideta kohalikul kasutajal saada root \u00f5igused, kirjutades andmeid lehek\u00fcljekassasse. CVE-ide idendit ei ole veel m\u00e4\u00e4ratud, lisaks eksploiti koodile pole probleemist veel mingit teavet. Parandus on saadaval ainult plaastrina, mis avaldati 20. mail ja 21. mail aktsepteeriti.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GRO Frag \u2014 \u0441\u0435\u0434\u044c\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u0430 Copy Fail, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0430\u0432\u0430 root \u0432 Linux | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u0441\u0435\u0434\u044c\u043c\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (1, 2-3, 4, 5, 6) \u0432 \u044f\u0434\u0440\u0435 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0435\u0449\u0451 \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d, \u043a\u0440\u043e\u043c\u0435 \u043a\u043e\u0434\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u043a\u0430 \u043d\u0435\u0442. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d 20 \u043c\u0430\u044f \u0438 21 \u043c\u0430\u044f \u0431\u044b\u043b \u043f\u0440\u0438\u043d\u044f\u0442","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-22T22:25:11+00:00","article:modified_time":"2026-05-22T22:25:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=181668"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181668\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=181668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=181668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=181668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}