{"id":181735,"date":"2026-05-25T20:48:34","date_gmt":"2026-05-25T18:48:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root"},"modified":"2026-05-25T20:48:34","modified_gmt":"2026-05-25T18:48:34","slug":"gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","title":{"rendered":"GRO Frag: uus LPE-haavatavus Linuxi v\u00f5rgu virnas v\u00f5imaldab saada root \u00f5igusi.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/p>\n

Avaldati eksploiti GRO Frag<\/strong> \u2014 kohalik privileegide t\u00f5stmise haavatavus Linuxi tuumas, mis on seotud GRO t\u00f6\u00f6tlemise ja zero-copy skb-ga v\u00f5rgu s\u00e4\u00e4stekihtides. Avalikes materjalides ei ole esialgse avastamise t\u00e4pset kuup\u00e4eva m\u00e4rgitud<\/strong>. Avalike j\u00e4lgede p\u00f5hjal saab v\u00e4lja tuua kaks kuup\u00e4eva: parandus arutati netdev postituste nimekirjas 20. mai 2026<\/strong>, kus seda haavatavust on juba kirjeldatud kui page cache'i \u00fcmberkirjutamiseks sobivat, ning avalik PoC avaldati GitHub Gist<\/a> 22. mai 2026<\/strong>.<\/p>\n

<\/noindex><\/noindex><\/p>\n

Ajutise meetmena, kuni parandatud tuuma on installitud, saab r\u00fcnnakusuunda piirata sysctl kaudu: kernel.io_uring_disabled=1. See re\u017eiim keelab uute io_uring eksemplaride loomise mitteprivilgeeritud protsesside poolt, kui need ei ole lubatud io_uring_group r\u00fchmas; r\u00fchma v\u00e4\u00e4rtusega -1 on juurdep\u00e4\u00e4s saadaval ainult CAP_SYS_ADMIN-i \u00f5igustega protsessidele. See on pigem leevendus kui t\u00f5eline haavatavuse parandus.<\/p>\n

Probleem esineb funktsioonis skb_gro_receive(): GRO paketide \u00fchendamisel v\u00f5is tuuma fragmentide zero-copy skb edastada teise skb, ilma et oleks korrektselt kontrollitud zero-copy olekut ja m\u00e4rki SKBFL_MANAGED_FRAG_REFS. Selle tulemusena v\u00f5isid m\u00e4lu lehed, millele algne skb ei hoidnud eraldi viiteid, valesti vabastada, p\u00f5hjustades use-after-free. Patches on selgelt m\u00e4rgitud, et selline olukord v\u00f5ib p\u00f5hjustada UAF-i ning et leitud variant oli sobiv page cache'i \u00fclekirjutamiseks.<\/p>\n

<\/p>\n

Avalik PoC kirjeldab haavatavust kui LPE l\u00e4bi GRO managed-frag UAF<\/strong> io_uring SEND_ZC ja virtuaalse v\u00f5rgu liidese veth kasutamise kaudu. Koodi kommentaaris on m\u00e4rgitud, et m\u00f5jutatud on kernelid Linux 6.0+<\/strong>, ekspluateerimine on v\u00f5imalik mitteprivileegitud kasutaja poolt, kuid n\u00f5uab kergesti ligip\u00e4\u00e4setavat io_uring; paranduseks on nimetatud kommitt<\/a> 4db79a322db8 muudatusega \u00abnet: gro: don\u2019t merge zcopy skbs\u00bb.<\/p>\n

<\/noindex>
\n<\/p>\n

GRO Fragi tagaj\u00e4rjed kuuluvad samasse ohtlikku vigade klassi nagu Copy Fail ja Dirty Frag: r\u00fcndaja, kellel on kohalik madala privileegiga juurdep\u00e4\u00e4s, suudab muuta andmeid page cache'is, st m\u00e4lus, ilma et oleks vajalik faili muutmine kettal. Sellised vead on eriti ebameeldivad, kuna need m\u00f5jutavad piiri faili \"ainult lugemiseks\" ja tegeliku sisu vahel, mida tuuma ja protsessid n\u00e4evad j\u00e4rgmiste p\u00e4ringute k\u00e4igus. Elastic on varem kirjeldanud<\/a> seda klassi kui praktilist viisi root'i hankimiseks page-cache'i rikutuse kaudu.<\/p>\n

<\/noindex><\/p>\n

K\u00e4esoleva v\u00e4ljaande ilmumise hetkel ei olnud GRO Fragi jaoks eraldi CVE-identifikaatorit, nagu n\u00e4itavad kergesti k\u00e4ttesaadavad aruanded. Ajutiste meetmete osas peaksid administratorid j\u00e4rgima tuuma v\u00e4rskendamist versioonile, mis sisaldab parandust, samuti rakendama \u00fcldisi riski maandamise meetmeid sarnaste LPE-de puhul: piirama mitteprivilegeeritud kasutaja nimesidu seal, kus see on v\u00f5imalik, kontrollima io_uring'i kasutamist ja j\u00e4lgima kahtlaseid ahelasi, mis on seotud kohalikku privileegide eskaleerimisega. Seotud Copy Fail\/DityFrag r\u00fcnnakute puhul soovitab Elastic samuti kombineerida patchimist madalas tasemes olevate haavatavuse ekspluateerimise primitiivide tuvastamisega.<\/p>\n

Madala taseme primitiivid ekspluateerimisel ei ole mitte \u201evalmis h\u00e4kk\u201c vaid p\u00f5hitehnilised meetodid, millest eksploit ehitatakse.<\/p>\n

GRO Fragi kontekstis v\u00f5ib see t\u00e4hendada, et ei tuvastata juba valminud fakti \u201ekasutaja on saanud root-i\u201c, vaid p\u00fc\u00fcda m\u00e4rgata \u00fcksikute kahtlaste tegevuste, mida eksploit kasutab tee k\u00f5rgemate privileegide saavutamiseks.<\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435. \u0422\u043e\u0447\u043d\u0430\u044f \u0434\u0430\u0442\u0430 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430\u0445 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u0430. \u041f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0441\u043b\u0435\u0434\u0430\u043c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0435 \u0434\u0430\u0442\u044b: \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u043b\u043e\u0441\u044c \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 netdev 20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430, \u0433\u0434\u0435 \u0434\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181735","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GRO Frag: uus LPE-haavatavus Linuxi v\u00f5rgu j\u00e4rgus v\u00f5imaldab saada root-\u00f5igused | ProHoster","description":"Avalikuses kasutamiseks on saadaval GRO Fragi eksploit \u2014 kohalik privileegide t\u00f5stmise haavatavus Linuxi kerneli t\u00f5hususes, mis on seotud GRO ja zero-copy skb t\u00f6\u00f6tlemisega v\u00f5rgu j\u00e4rgus. T\u00e4pne kuup\u00e4ev esialgsest avastamisest avalikes materjalides puudub. Avastruktuurist v\u00f5ib fikseerida kaks kuup\u00e4eva: parandust arutati netdev meililoendis 20. mail 2026, kus see haavatavus.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GRO Frag: \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435 Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435. \u0422\u043e\u0447\u043d\u0430\u044f \u0434\u0430\u0442\u0430 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430\u0445 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u0430. \u041f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0441\u043b\u0435\u0434\u0430\u043c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0435 \u0434\u0430\u0442\u044b: \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u043b\u043e\u0441\u044c \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 netdev 20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430, \u0433\u0434\u0435 \u0434\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-25T18:48:34+00:00","article:modified_time":"2026-05-25T18:48:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=181735"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181735\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=181735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=181735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=181735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}