{"id":170805,"date":"2026-05-16T06:24:28","date_gmt":"2026-05-16T04:24:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-linux-podsisteme-pidfd-pozvolyayushhaya-prochitat-nedostupnye-polzovatelyu-fajly"},"modified":"2026-05-16T06:24:28","modified_gmt":"2026-05-16T04:24:28","slug":"uyazvimost-v-linux-podsisteme-pidfd-pozvolyayushhaya-prochitat-nedostupnye-polzovatelyu-fajly","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-linux-podsisteme-pidfd-pozvolyayushhaya-prochitat-nedostupnye-polzovatelyu-fajly","title":{"rendered":"Foltoss\u00e1g a Linux pidfd-alrendszer\u00e9ben, amely lehet\u0151v\u00e9 teszi a felhaszn\u00e1l\u00f3 sz\u00e1m\u00e1ra el\u00e9rhetetlen f\u00e1jlok olvas\u00e1s\u00e1t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A Linux kernel has revealed a fifth critical vulnerability (1, 2, 3) in the last two weeks, allowing a user to escalate their privileges in the system. Two working exploits have been published: sshkeysign_pwn allows an unprivileged user to read the contents of protected host SSH keys \/etc\/ssh\/ssh_host_*_key, while chage_pwn \u2014 allows reading the contents of the \/etc\/shadow file with user password hashes. <\/p>\n
The details of the vulnerability were not intended for disclosure, but one of the security researchers managed to identify the essence of the vulnerability based on the patch proposed for the kernel, allowing files accessible only to the root user, such as \/etc\/shadow, to be read. The change added to the kernel adjusted the logic of using the get_dumpable() function in ptrace when determining access level in the ptrace_may_access() function. <\/p>\n
The vulnerability itself is caused by a race condition that leads to the possibility of unprivileged access to the pidfd file descriptor after accessing a file from a suid root process. At the moment between opening the file and dropping privileges in the suid program (for example, through the setreuid function), there arises a situation where the application that launched the suid root program can access the file opened in the suid program through the pidfd descriptor, even if file access rights do not permit this. <\/p>\n
The exploitation window arises because the function \u00ab__ptrace_may_access()\u00bb bypasses the file access check if the task->mm field is set to NULL after executing exit_mm() but before calling exit_files(). Currently, the system call pidfd_getfd assumes that the user ID (uid) of the calling process matches the ID granted access to the file. Notably, the issue was already highlighted in 2020, but it remains unresolved. <\/p>\n
In the exploit that retrieves the content of \/etc\/shadow, the attack boils down to cyclically launching the \/usr\/bin\/chage application with the suid root flag, reading the contents of \/etc\/shadow. After the process forks, the pidfd_open system call is executed and a cyclic enumeration of available pidfd descriptors is carried out through the pidfd_getfd system call and checked via \/proc\/self\/fd. In the sshkeysign_pwn exploit, similar manipulations are performed with the suid root program ssh-keysign. <\/p>\n
A CVE identifier for the problem has not yet been assigned, and updates for the kernel and packages in the distributions have not been published. The vulnerabilities are still present in kernels 7.0.7, 6.18.30, and 6.12.88 released a few hours ago. At the time of writing, only a patch can be used. Possible workarounds to block the vulnerability are being discussed, such as setting sysctl kernel.yama.ptrace_scope=3 or removing the suid root flag from executable files in the system (at least from the ssh-keysign and chage utilities used in exploits).