{"id":181690,"date":"2026-05-23T18:24:43","date_gmt":"2026-05-23T16:24:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux"},"modified":"2026-05-23T18:24:43","modified_gmt":"2026-05-23T16:24:43","slug":"opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","title":{"rendered":"Avalikustatud PoC DirtyDecrypt jaoks \u2014 uus LPE-haavatavus Linuxi tuumas","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/p>\n

Avaldatud proof-of-concept haavatavuse kohta DirtyDecrypt<\/strong>, tuntud ka kui DirtyCBC<\/strong>, mis v\u00f5imaldab kohalikel privileege mittesaanud kasutajatel saada root-\u00f5igusi m\u00f5nedes Linuxi s\u00fcsteemides. Probleem esineb koodis rxgk<\/strong> alams\u00fcsteemis RxRPC<\/strong> ja on seotud page cache'i kirjutamisega, kuna funktsioonis rxgk_decrypt_skb() puudub copy-on-write kontroll. BleepingComputer teatas PoC avaldamisest 18. mail 2026; ise PoC on avaldatud meeskonna V12 hoidlas<\/a>.<\/p>\n

<\/noindex><\/noindex><\/p>\n

<\/p>\n

RxRPC on Linuxi tuuma v\u00f5rguprotokoll<\/a> UDP peal, mis pakub usaldusv\u00e4\u00e4rset transporti kaugtehingute jaoks. Tuuma dokumentatsioonis on eraldi mainitud, et AFS<\/strong> \u2014 Andrew File System \u2014 on n\u00e4ide rakendusest, mis kasutab RxRPC-t, ning protokoll toetab \u00fchenduste turvap\u00f6\u00f6rangute l\u00e4bir\u00e4\u00e4kimisi. Just sellele valdkonnale kuulub RxGK, mis on vajalik RxRPC\/AFS turvaliseks re\u017eiimiks.<\/p>\n

<\/noindex><\/p>\n

V12 kirjelduse kohaselt on DirtyDecrypt veel \u00fcks variant haavatavustest, mis kuuluvad klassi CopyFail \/ Dirty Frag \/ Fragnesia<\/strong>. K\u00f5ik need keskenduvad sarnasele ideele: tuumam\u00e4lu, page cache ja puhverdatud andmete vale t\u00f6\u00f6tlemine v\u00f5ib lubada privileegideta kohalikul protsessil m\u00f5jutada andmeid, mida ei tohiks kirjutada. DirtyDecrypt'i puhul on tegemist 'rxgk pagecache write' probleemiga, kuna rxgk_decrypt_skb() ei oma COW-kaitset.<\/p>\n

V12 meeskond v\u00e4idab, et nad avastasid ja r\u00e4\u00e4kisid probleemist 9. mai 2026<\/strong>, kuid kaasnevad tuumad vastasid, et see on juba parandatud vea duplikaat. P\u00e4rast seda avaldasid teadlased PoC, p\u00f5hjendades, et parandus on juba mainline-keres.<\/p>\n

CVE olukord ei tundu t\u00e4iesti selge. BleepingComputer kirjutab, et eraldi ametlikku CVE-d DirtyDecrypt nime all pole avaldamise hetkel, kuid anal\u00fc\u00fctik Will Dormann seondab avaldatud V12 \u00fcksikasjad CVE-2026-31635<\/strong>, mis parandati aprilli l\u00f5pus. NVD andmebaasis on CVE-2026-31635 kirjeldatud kui viga rxrpc-s: funktsioon rxgk_verify_response() kontrollis RESPONSE autendit v\u00e4\u00e4ralt, mille t\u00f5ttu v\u00f5is liiga suur autentija sattuda rxgk_decrypt_skb() sisse ja viia koodi BUG_ON(len)-ni.<\/p>\n

<\/p>\n

See t\u00e4hendab, et avalikud teated seovad DirtyDecrypt'i nimelt CVE-2026-31635<\/a><\/strong>, kuid CVE ametlikku kirjeldust NVD-s vaadates tundub, et see on kitsam ja r\u00e4\u00e4gib eelk\u00f5ige rxrpc pikkuse kontrollimise veast, mitte otse alias DirtyDecrypt\/DirtyCBC eraldi kirjana. Seega on \u00f5igustatud kirjutada: DirtyDecrypt vastab t\u00f5en\u00e4oliselt v\u00f5i on tihedalt seotud CVE-2026-31635<\/em>, mitte v\u00e4ita, et see on CVE ametlik nimi.<\/p>\n

<\/noindex><\/p>\n

Eksploitatsiooniks on vajalik kernel, millel on lubatud valik CONFIG_RXGK<\/strong>, mis lubab RxGK toetust AFS-kliendile ja v\u00f5rgu transiidile. See kitsendab oluliselt m\u00f5jutatud s\u00fcsteemide ringi: peamiselt r\u00e4\u00e4gime distributsioonidest, mis j\u00e4rgivad kiiresti upstream-kerneli, sealhulgas Fedora<\/strong>, Arch Linuxis<\/strong> ja openSUSE Tumbleweed<\/strong>. Samas r\u00f5hutab BleepingComputer, et avaldatud V12 PoC testiti ainult Fedora ja mainline-kernelil.<\/p>\n

<\/p>\n

DirtyDecrypt ilmus mitme sarnase Linuxi LPE-haavatavuse seeria taustal. Varem avastati Copy Fail<\/strong> algif_aead-s, Dirty Frag<\/strong> v\u00f5rgu komponentides, ja seej\u00e4rel Fragnesia<\/strong> XFRM ESP-in-TCP-s. Microsoft kirjeldas<\/a> Dirty Frag'i kui kohalikku privileegide t\u00f5stmist esp4, esp6 ja rxrpc komponentide kaudu, mis v\u00f5imaldab r\u00fcndajal p\u00e4rast kohaliku ligip\u00e4\u00e4su saamist t\u00f5usta root'i tasemele ja s\u00fcsteemis kindlaks j\u00e4\u00e4da.<\/p>\n

<\/noindex><\/p>\n

Selliste vigade praktiline oht seisneb selles, et neid kasutatakse sageli p\u00e4rast esmast h\u00e4kkimist: n\u00e4iteks p\u00e4rast SSH-konto, veebikeskkonna, haavatava konteineri v\u00f5i madala privileegiga teenusekasutaja kompromiteerimist. Saades root-juurdep\u00e4\u00e4su, saab r\u00fcndaja v\u00e4lja l\u00fclitada kaitsemeetmed, lugeda saladusi, muuta logisid, rakendada p\u00fcsimaj\u00e4\u00e4mist ja liikuda edasi infrastruktuuri.<\/p>\n

Kasutajatele, keda v\u00f5ivad m\u00f5jutada rolling-release-distributsioonid, soovitatakse paigaldada viimased kerneli v\u00e4rskendused. S\u00fcsteemide puhul, kus kohene v\u00e4rskendus ei ole v\u00f5imalik, mainitakse v\u00e4ljaannetes ajutisi meetmeid, nagu kasutamata rxrpc-moodulite ja seotud komponentide v\u00e4ljal\u00fclitamine, kuid sellised ringlahendused v\u00f5ivad rikkuda AFS-i ja osa IPsec\/VPN-skenaaridest, seega tuleks neid rakendada alles p\u00e4rast konkreetse s\u00fcsteemi m\u00f5jude kontrollimist.<\/p>\n

Enamikul lauadel ja serveri seadistustel on risk t\u00f5en\u00e4oliselt v\u00e4iksem kui Copy Fail: DirtyDecrypt n\u00f5uab spetsiifilist tuumakonfiguratsiooni ja kohalikku koodi t\u00e4itmist. Siiski on Fedora, Arch Linux, openSUSE Tumbleweed ja teised kiiresti uuendatavad tuumaga s\u00fcsteemid seda probleemi p\u00f5hjustanud: see ei ole enam teoreetiline aruanne, vaid haavatavus, millel on avalik PoC ja arusaadav tee privileegide t\u00f5stmiseks.<\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043a\u043e\u0434\u0435 rxgk \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b RxRPC \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0432 page cache \u0438\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 copy-on-write \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 rxgk_decrypt_skb(). \u041e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 PoC 18 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u043e \u0438\u0437\u0434\u0430\u043d\u0438\u0435 BleepingComputer; \u0441\u0430\u043c PoC \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181690","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Avaldatud PoC DirtyDecrypt'i kohta \u2014 uus LPE-haavatavus Linuxi tuumas | ProHoster","description":"Avaldatud on proof-of-concept haavatavusele DirtyDecrypt, tuntud ka kui DirtyCBC, mis v\u00f5imaldab kohaliku mitteprivileegitud kasutaja saada root'i \u00f5igusi m\u00f5nedes Linuxi s\u00fcsteemides. Probleem seisneb rxgk alamregisteri RxRPC koodis ja on seotud page cache'i kirjutamisega, kuna funktsioonis rxgk_decrypt_skb() puudub copy-on-write kontroll. PoC avaldamisest teatas 18. mail 2026 v\u00e4ljaanne BleepingComputer; ise PoC on paigutatud","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC \u0434\u043b\u044f DirtyDecrypt \u2014 \u043d\u043e\u0432\u043e\u0439 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043a\u043e\u0434\u0435 rxgk \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b RxRPC \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0432 page cache \u0438\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 copy-on-write \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 rxgk_decrypt_skb(). \u041e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 PoC 18 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u043e \u0438\u0437\u0434\u0430\u043d\u0438\u0435 BleepingComputer; \u0441\u0430\u043c PoC \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-23T16:24:43+00:00","article:modified_time":"2026-05-23T16:24:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=181690"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181690\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=181690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=181690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=181690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}