A Linux kernel two vulnerabilities have been identified, similar in essence to the Copy Fail vulnerability revealed a few days ago, but manifesting in other subsystems \u2014 xfrm-ESP and RxRPC. The series of vulnerabilities has been assigned the code name Dirty Frag (there is also mention of Copy Fail 2). The vulnerabilities allow an unprivileged user to gain root privileges by overwriting process data in the page cache. An exploit is available that works on all current Linux distributions. Information about the vulnerability was disclosed before the release of patches, but there is a workaround to block the issue. <\/p>\n
Dirty Frag covers two different vulnerabilities: the first in the xfrm-ESP module, used to accelerate encryption operations in IPsec using the ESP (Encapsulating Security Payload) protocol, and the second in the RxRPC driver, which implements the AF_RXRPC socket family and the corresponding RPC protocol working over UDP. Each of the vulnerabilities separately allows gaining root privileges. The vulnerability in xfrm-ESP has existed in the Linux kernel since January 2017, while the vulnerability in RxRPC has been present since June 2023. Both problems are caused by optimizations that allow direct writing to the page cache. <\/p>\n
Az xfrm-ESP sebezhet\u0151s\u00e9g\u00e9nek kihaszn\u00e1l\u00e1s\u00e1hoz a felhaszn\u00e1l\u00f3nak jogot kell kapnia n\u00e9vt\u00e9r l\u00e9trehoz\u00e1s\u00e1ra, m\u00edg az RxRPC sebezhet\u0151s\u00e9g\u00e9nek kihaszn\u00e1l\u00e1s\u00e1hoz sz\u00fcks\u00e9ges a rxrpc.ko kernel modul bet\u00f6lt\u00e9s\u00e9nek lehet\u0151s\u00e9ge. P\u00e9ld\u00e1ul az Ubuntuban az AppArmor szab\u00e1lyai miatt a nem privilegiz\u00e1lt felhaszn\u00e1l\u00f3knak tilos n\u00e9vterek l\u00e9trehoz\u00e1sa, de alap\u00e9rtelmezettk\u00e9nt a rxrpc.ko modul bet\u00f6lt\u0151dik. N\u00e9h\u00e1ny disztrib\u00faci\u00f3ban hi\u00e1nyzik a rxrpc.ko modul, de nem blokkolj\u00e1k a n\u00e9vterek l\u00e9trehoz\u00e1s\u00e1t. A probl\u00e9m\u00e1t felfedez\u0151 kutat\u00f3 egy kombin\u00e1lt exploitot k\u00e9sz\u00edtett, amely k\u00e9pes a rendszer t\u00e1mad\u00e1s\u00e1ra mindk\u00e9t sebezhet\u0151s\u00e9gen kereszt\u00fcl, \u00edgy lehet\u0151v\u00e9 t\u00e9ve a probl\u00e9ma kihaszn\u00e1l\u00e1s\u00e1t minden f\u0151bb disztrib\u00faci\u00f3ban. Az exploit tesztel\u00e9se meger\u0151s\u00edt\u00e9st nyert az Ubuntu 24.04.4 verzi\u00f3j\u00e1val, a 6.17.0-23 kernel verzi\u00f3val, a RHEL 10.1-gyel a 6.12.0-124.49.1 kernel verzi\u00f3val, az openSUSE Tumbleweed 7.0.2-1 kernel verzi\u00f3j\u00e1val, a CentOS Stream 10-zel a 6.12.0-224 kernel verzi\u00f3val, az AlmaLinux 10-zel a 6.12.0-124.52.3 kernel verzi\u00f3val \u00e9s a Fedora 44-gyel a 6.19.14-300 kernel verzi\u00f3val. <\/p>\n
Ahogyan a Copy Fail sebezhet\u0151s\u00e9g eset\u00e9ben, az xfrm-ESP \u00e9s RxRPC probl\u00e9m\u00e1it is az adatok helysz\u00edni visszafejt\u00e9se okozza a splice() f\u00fcggv\u00e9ny haszn\u00e1lat\u00e1val, amely adatok \u00e1tvitel\u00e9t v\u00e9gzi f\u00e1jl- \u00e9s csatornadeszkiptorok k\u00f6z\u00f6tt m\u00e1sol\u00e1s n\u00e9lk\u00fcl, hivatkoz\u00e1sok tov\u00e1bb\u00edt\u00e1s\u00e1val a lapoz\u00e1si gyors\u00edt\u00f3t\u00e1rban. A fel\u00edr\u00e1si m\u0171velethez sz\u00fcks\u00e9ges eltol\u00e1sok megfelel\u0151 ellen\u0151rz\u00e9sek n\u00e9lk\u00fcl lettek kisz\u00e1m\u00edtva, figyelmen k\u00edv\u00fcl hagyva a lapoz\u00e1si gyors\u00edt\u00f3t\u00e1rban l\u00e9v\u0151 elemek k\u00f6zvetlen hivatkoz\u00e1s\u00e1nak haszn\u00e1lat\u00e1t, lehet\u0151v\u00e9 t\u00e9ve, hogy k\u00fcl\u00f6nlegesen form\u00e1zott k\u00e9r\u00e9sek k\u00fcld\u00e9s\u00e9vel 4 b\u00e1jtot \u00edrjunk fel a v\u00e1lasztott eltol\u00e1sn\u00e1l, megv\u00e1ltoztatva ez\u00e1ltal a lapoz\u00e1si gyors\u00edt\u00f3t\u00e1rban b\u00e1rmely f\u00e1jl tartalm\u00e1t. <\/p>\n
All file read operations initially return content from the page cache. If data is modified in the page cache, file read operations will return not the actual information stored on the drive, but the substituted data. Exploiting the vulnerability involves changing the page cache for an executable file with the suid root flag. For example, to gain root privileges, one can read the executable file \/usr\/bin\/su to place it in the page cache, after which it is possible to substitute one's own code into the content of the file loaded into the page cache. The subsequent execution of the \u2018su\u2019 utility will lead to the loading of a modified copy from the page cache into memory, rather than the original executable file from the drive. <\/p>\n
A sebezhet\u0151s\u00e9gek nyilv\u00e1noss\u00e1gra hozatal\u00e1t \u00e9s a probl\u00e9m\u00e1k orvosl\u00e1s\u00e1ra vonatkoz\u00f3 friss\u00edt\u00e9sek \u00f6sszehangolt kiad\u00e1s\u00e1t m\u00e1jus 12-re terveztek, azonban az inform\u00e1ci\u00f3sziv\u00e1rg\u00e1s miatt a sebezhet\u0151s\u00e9g adatait a jav\u00edt\u00e1sok k\u00f6zz\u00e9t\u00e9tele el\u0151tt kellett nyilv\u00e1noss\u00e1gra hozni. \u00c1prilis v\u00e9g\u00e9n a netdev nyilv\u00e1nos levelez\u0151list\u00e1j\u00e1n publik\u00e1l\u00e1sra ker\u00fcltek a rxrpc, ipsec \u00e9s xfrm patch-ek, an\u00e9lk\u00fcl, hogy eml\u00edtett\u00e9k volna, hogy a sebezhet\u0151s\u00e9g orvosl\u00e1s\u00e1val \u00e1llnak \u00f6sszef\u00fcgg\u00e9sben. M\u00e1jus 5-\u00e9n az IPsec alrendszer karbantart\u00f3ja elfogadta a git-repozit\u00f3riumban a netdev v\u00e1ltoztat\u00e1s\u00e1t a xfrm-esp modulhoz javasolt jav\u00edt\u00e1ssal, amelynek le\u00edr\u00e1sa nagyr\u00e9szt megism\u00e9telte a Copy Fail sebezhet\u0151s\u00e9g probl\u00e9m\u00e1j\u00e1ra vonatkoz\u00f3 le\u00edr\u00e1st az algif_aead modulban. Az egyik biztons\u00e1gi kutat\u00f3 \u00e9rdekl\u0151dni kezdett ez ir\u00e1nt a jav\u00edt\u00e1s ir\u00e1nt, siker\u00fclt egy m\u0171k\u00f6d\u0151 exploitot l\u00e9trehoznia \u00e9s k\u00f6zz\u00e9tennie, nem tudva arr\u00f3l, hogy az inform\u00e1ci\u00f3k nyilv\u00e1noss\u00e1gra hozatal\u00e1ra m\u00e1jus 12-ig embarg\u00f3t rendeltek el. <\/p>\n
A Linux kernel \u00e9s a csomagok friss\u00edt\u00e9sei m\u00e9g nem ker\u00fcltek nyilv\u00e1noss\u00e1gra a disztrib\u00faci\u00f3kban, de a probl\u00e9m\u00e1kat orvosl\u00f3 jav\u00edt\u00f3programok el\u00e9rhet\u0151k - xfrm-esp \u00e9s rxrpc. A CVE-azonos\u00edt\u00f3k nem lettek hozz\u00e1rendelve, ami megnehez\u00edti a csomagfriss\u00edt\u00e9sek nyomon k\u00f6vet\u00e9s\u00e9t a disztrib\u00faci\u00f3kban. Mint ideiglenes v\u00e9delmi l\u00e9p\u00e9st, le lehet tiltani az esp4, esp6 \u00e9s rxrpc kernel modulok bet\u00f6lt\u00e9s\u00e9t: sh -c 'printf 'install esp4 \/bin\/false\ninstall esp6 \/bin\/false\ninstall rxrpc \/bin\/false\n' > \/etc\/modprobe.d\/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>\/dev\/null; true' \u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u0443\u0442\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail, \u043d\u043e \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 — xfrm-ESP \u0438 RxRPC. \u0421\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Dirty Frag (\u0442\u0430\u043a\u0436\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 Copy Fail 2). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170523","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dirty Frag hib\u00e1k, amelyek megv\u00e1ltoztatj\u00e1k az oldal cache-t root megszerz\u00e9se \u00e9rdek\u00e9ben b\u00e1rmely Linux disztrib\u00faci\u00f3ban | ProHoster","description":"A Linux kernelben k\u00e9t hib\u00e1t fedeztek fel, amelyek l\u00e9nyeg\u00e9ben anal\u00f3gok a n\u00e9h\u00e1ny nappal ezel\u0151tt felfedett Copy Fail hib\u00e1val, de m\u00e1s alrendszerekben jelentkeznek - xfrm-ESP \u00e9s RxRPC.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Dirty Frag, \u0438\u0437\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043a\u044d\u0448 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root \u0432 \u043b\u044e\u0431\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u0443\u0442\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail, \u043d\u043e \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 - xfrm-ESP \u0438 RxRPC.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-08T10:24:30+00:00","article:modified_time":"2026-05-08T10:24:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/170523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=170523"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/170523\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=170523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=170523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=170523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"