{"id":183410,"date":"2026-09-20T10:54:15","date_gmt":"2026-09-20T08:54:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/opasnye-uyazvimosti-v-yadre-linux-kvm-exim-unbound-ghostscript-i-suricata"},"modified":"2026-09-20T10:54:15","modified_gmt":"2026-09-20T08:54:15","slug":"serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","title":{"rendered":"Ohtlikud haavatavused Linuxi tuumas, KVM, Exim, Unbound, Ghostscript ja Suricata","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Mitmest hiljuti avastatud t\u00f5sisest haavatavusest, mis v\u00f5imaldavad saada root-juurdep\u00e4\u00e4su s\u00fcsteemis v\u00f5i saavutada kaugk\u00e4itamise koodi.  <\/p>\n<ul>\n<li class=\"l\"> Paljastatud neli haavatavust Linuxi kernelis, mis annavad mittep\u00e4devatele kohalikele kasutajatele v\u00f5imaluse t\u00e4ita koodi root-\u00f5igustega. Probleemid on lahendatud Linuxi kerneli uuendustes 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 ja 7.2.4. K\u00f5igi haavatavuste jaoks on loodud eksploidid, mille t\u00f6\u00f6d on demonstreeritud Fedora 43\/44 ja Ubuntu 24.04. Esimese kolme haavatavuse ekspluateerimiseks on vajalik kasutaja nimede ruumide (user namespace) loomise v\u00f5imalus v\u00f5i CAP_NET_ADMIN \u00f5igused ning haavatavustes esinevate alams\u00fcsteemide toele (AH6\/XFRM, TUN, PPPoE ja SCTP) on toeks.\n<ul>\n<li class=\"l\"> DirtyAH6 (CVE-2026-80844, eksploit) \u2014 puhveri \u00fclevool IPsec AH (Authentication Header) t\u00f6\u00f6tlejas, mis tuleneb pealkirjas toodud v\u00e4\u00e4rtuste kontrollimise puudumisest. Lisaks kohalikule r\u00fcnnakule v\u00f5ib haavatavust teatud tingimustes teoreetiliselt kasutada ka kaugjuhtimise teel.\n<li class=\"l\"> TUNderflow (CVE-2026-81000, eksploit) \u2014 kirjutamine jaotatud puhvri piiridest v\u00e4lja vigase TUN-paketi t\u00f6\u00f6tlemisel.\n<li class=\"l\"> PPPoEject (CVE-2026-68121, eksploit) \u2014 juba vabastatud m\u00e4lu aadressile juurdep\u00e4\u00e4s PPPoE draiveris.\n<li class=\"l\"> DiagSpill (CVE-2026-74469, eksploit) \u2014 puhveri \u00fclevool SCTP protokolli diagnostikavahendites. Lisaks kohalikule r\u00fcnnakule v\u00f5ib haavatavust teatud tingimustes teoreetiliselt kasutada ka kaugjuhtimise teel.     <\/ul>\n<li class=\"l\"> Haavatavus (CVE-2026-89775) h\u00fcperviisoril <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/vps\/abuzoustojchivye-vps\/\" title=\"KVM\" data-wpil-keyword-link=\"linked\">KVM<\/a>, mis annab v\u00f5imaluse juurde p\u00e4\u00e4seda host-\u00fcmbrusele k\u00fclalis\u00fcsteemist. Kui mittesoovitud kasutajatel on juurdep\u00e4\u00e4s seadmele \/dev\/kvm (vaikimisi RHEL-is), saab haavatavust kasutada ka privileegide t\u00f5stmiseks s\u00fcsteemis. Probleem ilmneb ainult ARM64 arhitektuuriga s\u00fcsteemides, kus on lubatud sisemise virtualiseerimise tugi. Haavatavus on tingitud sellest, et suuruse arvutamise protseduur tagastas \u201e0\u201d, viidates sellele, et suurus on teadmata, ja m\u00e4lu lehek\u00fclgede vabastamise funktsioon t\u00f6\u00f6tles \u201e0\u201d kui t\u00e4pset v\u00e4\u00e4rtust ega puhastanud m\u00e4lu lehek\u00fclgi.\n<li class=\"l\"> Posti v\u00e4ljaandes <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-los-angeles\/\" title=\"serverid\" data-wpil-keyword-link=\"linked\">serverid<\/a> Exim 4.100.1 on parandatud 4 haavatavust: andmete lugemine puhverpiirist v\u00e4ljaspool ja unustatud andmete kasutamine Proxy protokolli rakenduses; m\u00e4lu juurde p\u00e4\u00e4semine p\u00e4rast selle vabastamist TLS-on-connect-i kasutamisel GnuTLS-i kasutades; s\u00f5numi lisamine teise voogu (SMTP smuggling).\n<li class=\"l\"> Ghostscript 10.08.0 paketis on k\u00f5rvaldatud haavatavus (CVE-2026-39919), mis tekkis puhvri \u00fclevoolust JPEG 2000 formaadi anal\u00fc\u00fcsi koodis, kui sub-sampling v\u00e4\u00e4rtused olid vale. Probleem v\u00f5ib viia koodi t\u00e4itmisele Ghostscriptis, kui t\u00f6\u00f6deldakse spetsiaalselt koostatud PDF-faile, kuhu on integreeritud JPEG 2000 formaadis pilte. Haavatavuse oht suureneb, kuna Ghostscripti kutsutakse esile t\u00f6\u00f6laual miniatuuride loomisel, taustal andmete indekseerimisel ja piltide konverteerimisel. Eduka r\u00fcnnaku jaoks piisab sageli lihtsalt exploiti sisaldava faili laadimisest v\u00f5i selle katalooge Nautiluses vaatamisest. Ghostscripti haavatavusi saab samuti \u00e4ra kasutada piltide k\u00e4sitlejate kaudu, mis p\u00f5hinevad ImageMagick ja GraphicsMagick paketidel, edastades neile JPEG v\u00f5i PNG faili, kus pildi asemel on PostScripti kood (sellist faili t\u00f6\u00f6deldakse Ghostscriptis, kuna MIME-t\u00fc\u00fcpi tuvastatakse sisu, mitte laiendi p\u00f5hjal). Probleem on k\u00f5rvaldatud Ghostscript 10.08.0.\n<li class=\"l\"> DNS-serveris Unbound 1.26.1 on parandatud 9 haavatavust, sealhulgas probleem CVE-2026-81642, mis toob kaasa puhveri \u00fclet\u00e4itumise teatud DNSKEY t\u00f6\u00f6tlemisel. Haavatavust saab kasutada koodi kaugk\u00e4ivitamiseks <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-dronten\/\" title=\"serveris\" data-wpil-keyword-link=\"linked\">serveris<\/a>. Samuti on parandatud: puhveri \u00fclet\u00e4itumine DNSSEC-i t\u00f6\u00f6tlemise koodis, m\u00e4lu kahjustamine CNAME t\u00f6\u00f6tleja juures, ja juba vabastatud m\u00e4lu juurde p\u00e4\u00e4semine DoQ ja DoH koodis.\n<li class=\"l\"> R\u00fcnnakute avastamise ja ennetamise s\u00fcsteemis Suricata 8.0.7 on k\u00f5rvaldatud 67 haavatavust, millest kaks on klassifitseeritud kriitilisteks. Probleemide kohta teavet ei jagata, kuid arvestades nende ohtu, on haavatavused v\u00f5imaldavad kaugkoodi t\u00e4itmist spetsiaalselt koostatud liikluse t\u00f6\u00f6tlemisel.  <\/ul>\n<p>Allikas: <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66310\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430. \u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0434\u0430\u044e\u0449\u0438\u0445 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u044f\u0434\u0440\u0430 Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 \u0438 7.2.4. \u0414\u043b\u044f \u0432\u0441\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b, \u0440\u0430\u0431\u043e\u0442\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183410","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, KVM, Exim, Unbound, Ghostscript \u0438 Suricata | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-20T08:54:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-20T08:54:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ohtlikud haavatavused Linuxi, KVM, Exim, Unbound, Ghostscript ja Suricata tuumades | ProHoster","description":"Mitmest hiljuti avastatud t\u00f5sisest haavatavusest, mis v\u00f5imaldavad saada root-juurdep\u00e4\u00e4su s\u00fcsteemis v\u00f5i saavutada kaugk\u00e4itamise koodi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, KVM, Exim, Unbound, Ghostscript \u0438 Suricata | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-09-20T08:54:15+00:00","article:modified_time":"2026-09-20T08:54:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"183410","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-09-22 16:20:59","updated":"2026-09-22 16:20:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=183410"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183410\/revisions"}],"predecessor-version":[{"id":183425,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183410\/revisions\/183425"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=183410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=183410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=183410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}