{"id":181735,"date":"2026-05-25T20:48:34","date_gmt":"2026-05-25T18:48:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root"},"modified":"2026-05-25T20:48:34","modified_gmt":"2026-05-25T18:48:34","slug":"gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","title":{"rendered":"GRO Frag: uus LPE-haavatavus Linuxi v\u00f5rgualus v\u00f5imaldab hankida root-i juurdep\u00e4\u00e4su","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/p>\n

Avaldas on eksploite avatud juurdep\u00e4\u00e4suga GRO Frag<\/strong> \u2014 lokaalne privileegide t\u00f5stmise haavatavus Linuxi tuumas, mis on seotud GRO ja zero-copy skb t\u00f6\u00f6tlemisega v\u00f5rgu stackis. Esialgse avastamise t\u00e4pset kuup\u00e4eva avalikes materjalides ei ole m\u00e4rgitud<\/strong>. Avatud j\u00e4lgedest on v\u00f5imalik fikseerida kaks kuup\u00e4eva: parandamine arutati netdev meililistis 20. mai 2026<\/strong>, kus seda haavatavust on juba kirjeldatud kui sobivat page cache'i \u00fcle kirjutamiseks, ja avalik PoC asetati GitHub Gist<\/a> 22. mai 2026<\/strong>.<\/p>\n

<\/noindex><\/noindex><\/p>\n

Ajutise meetmena enne parandatud tuuma installimist saab r\u00fcnnaku vektorit piirata j\u00e4rgmise sysctl seadistamisega: kernel.io_uring_disabled=1. See re\u017eiim keelab uusate io_uring eksemplaride loomise privileegita protsesside poolt, kui nad ei ole kaasatud lubatud r\u00fchma io_uring_group; grupi v\u00e4\u00e4rtuse -1 korral s\u00e4ilib juurdep\u00e4\u00e4s ainult protsesside jaoks, kellel on CAP_SYS_ADMIN. See on just mitiigeerimine, mitte t\u00e4ielik parandamine haavatavusele.<\/p>\n

Probleem on funktsiooni skb_gro_receive() sees: paketide GRO \u00fchendamisel v\u00f5is tuum edastada fragmentide zero-copy skb teise skb juurde ilma korrektse zero-copy oleku ja SKBFL_MANAGED_FRAG_REFS lipu kontrollimata. Selle tulemusena v\u00f5idi m\u00e4lu lehed, millele algne skb ei hoidnud eraldi viiteid, vabastada valesti, mis viis use-after-free'i olukorrani. Pat\u0441his on otseselt m\u00e4rgitud, et selline olukord v\u00f5ib viia UAF-ini, samuti et leitud variant oli sobilik page cache'i \u00fcle kirjutamiseks.<\/p>\n

<\/p>\n

Avalikustatud PoC kirjeldab haavatavust kui LPE l\u00e4bi GRO managed-frag UAF<\/strong> kasutades io_uring SEND_ZC ja virtuaalset v\u00f5rkaadressi veth. Koodis on m\u00e4rgitud, et m\u00f5jutatud on tuumad Linux 6.0+<\/strong>, ekspluateerimine on v\u00f5imalik privileegita kasutaja poolt, kuid n\u00f5uab kergesti k\u00e4ttesaadavat io_uring; paranduse nimeks on antud komiteed<\/a> 4db79a322db8 muudetud kujul \u00abnet: gro: don't merge zcopy skbs\u00bb.<\/p>\n

<\/noindex>
\n<\/p>\n

GRO Frag on tagaj\u00e4rgede poolest samas ohtlikus veaklassis nagu Copy Fail ja Dirty Frag: r\u00fcndaja, kellel on lokaalne privileegita juurdep\u00e4\u00e4s, saavutab page cache'i andmete muutmise, see t\u00e4hendab m\u00e4lu, ilma et fail oleks vajalikult muudetud kettal. Sellised vead on eriti ebameeldivad, kuna need m\u00f5jutavad piiri 'ainult lugemise' faili ja tegeliku sisu vahel, mida tuumad ja protsessid n\u00e4evad j\u00e4rgmistele p\u00e4ringutele. Elastic oma uurimustes kirjeldas<\/a> seda klassi kui praktilist teed root'i saamiseks page-cache'i korruptsiooni kaudu.<\/p>\n

<\/noindex><\/p>\n

Avaldamise hetkel ei olnud GRO Frag jaoks eraldi CVE-identifikaator veel m\u00e4\u00e4ratud, arvestades kergesti ligip\u00e4\u00e4setavaid teateid. Ajutiste meetmetena peaksid administraatorid keskenduma tuuma uuendamisele versioonile, kus on parandus, ning \u00fcldiste riskialandamise meetmete rakendamisele sarnaste LPE-de puhul: privileegideta kasutajate nimede ruumide piiramine seal, kus see on lubatud, io_uring'i kasutamise kontrollimine ja kahtlaste ahelate j\u00e4lgimine, mis on seotud kohaliku privileegide t\u00f5stmisega. Seotud Copy Fail\/DirtyFrag-r\u00fcnnakute puhul soovitab Elastic samuti kombineerida patchimist madala taseme ekspluateerimis primitiivide tuvastamisega.<\/p>\n

Madala taseme ekspluateerimis primitiivide all ei m\u00f5isteta mitte valmis \u201er\u00fcnnakut\u201d, vaid p\u00f5hilisi tehnilisi tehnikaid, millest eksploitat koostatakse.<\/p>\n

GRO Fragi kontekstis v\u00f5ib see t\u00e4hendada mitte valmis r\u00fcnnaku \u201ekasutaja sai root\u201d tuvastamist, vaid eraldi kahtlaste tegevuste m\u00e4rkamine, mida eksploit kasutab privileegide t\u00f5stmise teel.<\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435. \u0422\u043e\u0447\u043d\u0430\u044f \u0434\u0430\u0442\u0430 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430\u0445 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u0430. \u041f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0441\u043b\u0435\u0434\u0430\u043c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0435 \u0434\u0430\u0442\u044b: \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u043b\u043e\u0441\u044c \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 netdev 20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430, \u0433\u0434\u0435 \u0434\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181735","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47GRO Frag: uus LPE-haavatavus Linuxi v\u00f5rgu kogumis v\u00f5imaldab saavutada root \u00f5igusi | ProHoster","description":"Avalikus ruumis on ilmunud eksploit GRO Fragi jaoks \u2014 kohaliku privileegide t\u00f5stmise haavatavuse puhul Linuxi tuumas, mis on seotud GRO ja zero-copy skb t\u00f6\u00f6tlemisega v\u00f5rgu kogumis.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GRO Frag: \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435 Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-25T18:48:34+00:00","article:modified_time":"2026-05-25T18:48:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=181735"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/181735\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=181735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=181735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=181735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}