{"id":183410,"date":"2026-09-20T10:54:15","date_gmt":"2026-09-20T08:54:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/opasnye-uyazvimosti-v-yadre-linux-kvm-exim-unbound-ghostscript-i-suricata"},"modified":"2026-09-20T10:54:15","modified_gmt":"2026-09-20T08:54:15","slug":"opasnye-uyazvimosti-v-yadre-linux-kvm-exim-unbound-ghostscript-i-suricata","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/opasnye-uyazvimosti-v-yadre-linux-kvm-exim-unbound-ghostscript-i-suricata","title":{"rendered":"Ohtlikud haavatavused Linuxi tuumas, KVM, Exim, Unbound, Ghostscript ja Suricata","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Mitmest hiljuti avastatud t\u00f5sisest haavatavusest, mis v\u00f5imaldavad saada root-juurdep\u00e4\u00e4su s\u00fcsteemis v\u00f5i saavutada kaugk\u00e4itamise koodi.  <\/p>\n<ul>\n<li class=\"l\"> Paljastatud neli haavatavust Linuxi kernelis, mis annavad mittep\u00e4devatele kohalikele kasutajatele v\u00f5imaluse t\u00e4ita koodi root-\u00f5igustega. Probleemid on lahendatud Linuxi kerneli uuendustes 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 ja 7.2.4. K\u00f5igi haavatavuste jaoks on loodud eksploidid, mille t\u00f6\u00f6d on demonstreeritud Fedora 43\/44 ja Ubuntu 24.04. Esimese kolme haavatavuse ekspluateerimiseks on vajalik kasutaja nimede ruumide (user namespace) loomise v\u00f5imalus v\u00f5i CAP_NET_ADMIN \u00f5igused ning haavatavustes esinevate alams\u00fcsteemide toele (AH6\/XFRM, TUN, PPPoE ja SCTP) on toeks.\n<ul>\n<li class=\"l\"> DirtyAH6 (CVE-2026-80844, eksploit) \u2014 puhveri \u00fclevool IPsec AH (Authentication Header) t\u00f6\u00f6tlejas, mis tuleneb pealkirjas toodud v\u00e4\u00e4rtuste kontrollimise puudumisest. Lisaks kohalikule r\u00fcnnakule v\u00f5ib haavatavust teatud tingimustes teoreetiliselt kasutada ka kaugjuhtimise teel.\n<li class=\"l\"> TUNderflow (CVE-2026-81000, eksploit) \u2014 kirjutamine jaotatud puhvri piiridest v\u00e4lja vigase TUN-paketi t\u00f6\u00f6tlemisel.\n<li class=\"l\"> PPPoEject (CVE-2026-68121, eksploit) \u2014 juba vabastatud m\u00e4lu aadressile juurdep\u00e4\u00e4s PPPoE draiveris.\n<li class=\"l\"> DiagSpill (CVE-2026-74469, eksploit) \u2014 puhveri \u00fclevool SCTP protokolli diagnostikavahendites. Lisaks kohalikule r\u00fcnnakule v\u00f5ib haavatavust teatud tingimustes teoreetiliselt kasutada ka kaugjuhtimise teel.     <\/ul>\n<li class=\"l\"> Haavatavus (CVE-2026-89775) KVM h\u00fcperviisoris, mis v\u00f5imaldab k\u00fclgs\u00fcsteemist juurdep\u00e4\u00e4su host-\u00fcmbrusele. Kui mitteteenuselistel kasutajatel on juurdep\u00e4\u00e4s seadmele \/dev\/kvm (vaikes\u00e4tte j\u00e4rgi RHEL-is), saab haavatavust kasutada ka oma privileegide t\u00f5stmiseks s\u00fcsteemis. Probleem ilmneb ainult ARM64 arhitektuuriga s\u00fcsteemides, kus on lubatud sisemise virtualiseerimise tugi. Haavatavus tuleneb asjaolust, et suuruse arvutamise protseduur tagastas \"0\", viidates sellele, et suurus on teadmata, ja m\u00e4lu lehtede vabastamise funktsioon t\u00f6\u00f6tles \"0\" kui tegelikku v\u00e4\u00e4rtust ning ei puhastanud m\u00e4lu lehti.\n<li class=\"l\"> Exim 4.100.1 meilis on k\u00f5rvaldatud 4 haavatavust: andmete lugemine puhverpiiridest v\u00e4lja, mitte-initsialiseeritud andmete kasutamine Proxy protokollis; p\u00e4\u00e4s m\u00e4lu juurde p\u00e4rast selle vabastamist TLS-on-connect kasutamisel GnuTLS-i puhul; teate sisestamine vale k\u00fclje kaudu (SMTP smuggling).\n<li class=\"l\"> Ghostscript 10.08.0 paketis on k\u00f5rvaldatud haavatavus (CVE-2026-39919), mis tekkis puhvri \u00fclevoolust JPEG 2000 formaadi anal\u00fc\u00fcsi koodis, kui sub-sampling v\u00e4\u00e4rtused olid vale. Probleem v\u00f5ib viia koodi t\u00e4itmisele Ghostscriptis, kui t\u00f6\u00f6deldakse spetsiaalselt koostatud PDF-faile, kuhu on integreeritud JPEG 2000 formaadis pilte. Haavatavuse oht suureneb, kuna Ghostscripti kutsutakse esile t\u00f6\u00f6laual miniatuuride loomisel, taustal andmete indekseerimisel ja piltide konverteerimisel. Eduka r\u00fcnnaku jaoks piisab sageli lihtsalt exploiti sisaldava faili laadimisest v\u00f5i selle katalooge Nautiluses vaatamisest. Ghostscripti haavatavusi saab samuti \u00e4ra kasutada piltide k\u00e4sitlejate kaudu, mis p\u00f5hinevad ImageMagick ja GraphicsMagick paketidel, edastades neile JPEG v\u00f5i PNG faili, kus pildi asemel on PostScripti kood (sellist faili t\u00f6\u00f6deldakse Ghostscriptis, kuna MIME-t\u00fc\u00fcpi tuvastatakse sisu, mitte laiendi p\u00f5hjal). Probleem on k\u00f5rvaldatud Ghostscript 10.08.0.\n<li class=\"l\"> DNS-serveris Unbound 1.26.1 on k\u00f5rvaldatud 9 haavatavust, sealhulgas probleem CVE-2026-81642, mis viib puhvri \u00fclevooluni teatud DNSKEY-de t\u00f6\u00f6tlemisel. Haavatavust saab kasutada serveris kaugelt koodi t\u00e4itmiseks. Samuti on k\u00f5rvaldatud: puhvri \u00fclevool DNSSEC-i t\u00f6\u00f6tlemise koodis, m\u00e4lus andmete kahjustamine CNAME t\u00f6\u00f6tlejas, p\u00e4\u00e4s juba vabastatud m\u00e4lu juurde DoQ ja DoH koodis.\n<li class=\"l\"> R\u00fcnnakute avastamise ja ennetamise s\u00fcsteemis Suricata 8.0.7 on k\u00f5rvaldatud 67 haavatavust, millest kaks on klassifitseeritud kriitilisteks. Probleemide kohta teavet ei jagata, kuid arvestades nende ohtu, on haavatavused v\u00f5imaldavad kaugkoodi t\u00e4itmist spetsiaalselt koostatud liikluse t\u00f6\u00f6tlemisel.  <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66310\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430. \u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0434\u0430\u044e\u0449\u0438\u0445 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u044f\u0434\u0440\u0430 Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 \u0438 7.2.4. \u0414\u043b\u044f \u0432\u0441\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b, \u0440\u0430\u0431\u043e\u0442\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183410","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/opasnye-uyazvimosti-v-yadre-linux-kvm-exim-unbound-ghostscript-i-suricata\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, KVM, Exim, Unbound, Ghostscript \u0438 Suricata | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/opasnye-uyazvimosti-v-yadre-linux-kvm-exim-unbound-ghostscript-i-suricata\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-20T08:54:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-20T08:54:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ohtlikud haavatavused Linuxi, KVM, Exim, Unbound, Ghostscript ja Suricata tuumades | ProHoster","description":"Mitmest hiljuti avastatud t\u00f5sisest haavatavusest, mis v\u00f5imaldavad saada root-juurdep\u00e4\u00e4su s\u00fcsteemis v\u00f5i saavutada kaugk\u00e4itamise koodi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/opasnye-uyazvimosti-v-yadre-linux-kvm-exim-unbound-ghostscript-i-suricata","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, KVM, Exim, Unbound, Ghostscript \u0438 Suricata | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/opasnye-uyazvimosti-v-yadre-linux-kvm-exim-unbound-ghostscript-i-suricata","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-09-20T08:54:15+00:00","article:modified_time":"2026-09-20T08:54:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=183410"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183410\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=183410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=183410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=183410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}