{"id":172668,"date":"2026-05-19T06:24:52","date_gmt":"2026-05-19T04:24:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly"},"modified":"2026-05-19T12:52:18","modified_gmt":"2026-05-19T10:52:18","slug":"v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","title":{"rendered":"Linuxban elt\u00fcntett\u00e9k az ssh-keysign-pwn sebezhet\u0151s\u00e9get, amely lehet\u0151v\u00e9 tette a helyi felhaszn\u00e1l\u00f3k sz\u00e1m\u00e1ra a root f\u00e1jlok olvas\u00e1s\u00e1t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Linux kernel vulnerability has been fixed, informally named ssh-keysign-pwn<\/strong>. The issue allows a local unprivileged user to read files that should only be accessible to root, including private SSH host keys and, in specific scenarios, \/etc\/shadow. As of publication, a separate CVE for the issue has not yet been assigned.<\/p>\n

<\/p>\n

Despite the name, it is not a bug in OpenSSH as the sshd network server, but rather a defect<\/a> in the logic of the Linux kernel related to ptrace checks and access to file descriptors of another process through pidfd_getfd(2). The OpenSSH utility ssh-keysign turned out to be a convenient example of exploitation because it works with private host keys, which typically belong to root and are inaccessible to ordinary users.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

The essence of the error<\/a> lies in the fact that the function __ptrace_may_access() incorrectly handled the state of a process whose memory structure mm had disappeared, but which still had open file descriptors. During process termination, the kernel calls exit_mm() before closing files through exit_files(). In this short gap, the process appears to not have the usual user address space, but its open files still exist. Because of this, the 'dumpable' state check could be bypassed, and pidfd_getfd() could access another's file descriptor with a matching UID.<\/p>\n

<\/noindex> <\/p>\n

A practical scenario revolves around setuid programs that first open a sensitive file with root privileges, then drop privileges and terminate, still holding an open descriptor. The published description cites ssh-keysign as an example: it opens \/etc\/ssh\/ssh_host_{ecdsa,ed25519,rsa}_key, then drops rights and may terminate if EnableSSHKeysign is disabled. These keys should only be accessible to root as they are used for host-based authentication.<\/p>\n

The second example is chage, which can open \/etc\/shadow, then drop effective rights and terminate. As a result, the attack does not necessarily provide an immediate shell with root rights, but it allows access to the contents of files that are typically considered critically confidential. The leak of \/etc\/shadow is dangerous due to the potential for subsequent offline password cracking, and the leak of private SSH host keys poses the risk of host spoofing or attacks on trusted SSH scenarios.<\/p>\n

A jav\u00edt\u00e1s m\u00e1r beker\u00fclt a Linux f\u0151\u00e1g\u00e1ba. A 31e62c2ebbfd azonos\u00edt\u00f3j\u00fa commit, amelynek c\u00edme: ptrace: kicsit logikusabb 'get_dumpable()' logika, megv\u00e1ltoztatja a dumpability ellen\u0151rz\u00e9si viselked\u00e9s\u00e9t: a kernel mostant\u00f3l meg\u0151rzi a user_dumpable \u00e1llapotot, ha az mm elt\u0171nik, \u00e9s megk\u00f6veteli a helyes CAP_SYS_PTRACE ellen\u0151rz\u00e9st a megker\u00fcl\u00e9shez. A patch \u00e9rinti az include\/linux\/sched.h, kernel\/exit.c \u00e9s kernel\/ptrace.c f\u00e1jlokat.<\/p>\n

A sebezhet\u0151s\u00e9get a Qualys jelentette, \u00e9s Linus Torvalds 2026. m\u00e1jus 14-\u00e9n jav\u00edtotta. A Phoronix megjegyzi, hogy a k\u00f6zl\u00e9s id\u0151pontj\u00e1ban a probl\u00e9ma a Linux kernel \u00f6sszes kiad\u00e1s\u00e1t \u00e9rintette, eg\u00e9szen a legutols\u00f3 mainline \u00e1gig, a jav\u00edt\u00e1s alkalmaz\u00e1s\u00e1ig. A PoC szerz\u0151je is megeml\u00edti, hogy a 31e62c2ebbfd el\u0151tti kernel verzi\u00f3k sebezhet\u0151ek, bele\u00e9rtve a stabil \u00e1gakat, amelyek 2026. m\u00e1jus 14-\u00e9n tartottak.<\/p>\n

<\/p>\n

Fontos k\u00fcl\u00f6nbs\u00e9g, hogy a kihaszn\u00e1l\u00e1s\u00e1hoz nem sz\u00fcks\u00e9ges specifikus kernel modulok bet\u00f6lt\u00e9se, mint a k\u00f6zelm\u00faltban t\u00f6rt\u00e9nt LPE sebezhet\u0151s\u00e9gek eset\u00e9ben. El\u00e9g a rendszeren bel\u00fcli nem privilegiz\u00e1lt hozz\u00e1f\u00e9r\u00e9s, \u00e9s egy megfelel\u0151 privilegiz\u00e1lt seg\u00e9dprocesszus jelenl\u00e9te. A Debian fejleszt\u0151je, Daniel Baumann egy \u00f6nk\u00e9ntes megjegyezte, aki t\u00e1mogatja a magyar lokaliz\u00e1l\u00e1st, az \u00edr\u00e1studatlan v\u00e1ltozat elterjedtebb \u00e9s ismertebb a legt\u00f6bb felhaszn\u00e1l\u00f3 sz\u00e1m\u00e1ra (p\u00e9ld\u00e1ul a macOS fel\u00fclet\u00e9n az Apple \"M\u00e1sol\u00e1s\"-t haszn\u00e1l, m\u00edg a Windows alatt a Microsoft, amelynek felhaszn\u00e1l\u00f3i sz\u00e1ma sokkal nagyobb, mint a macOS felhaszn\u00e1l\u00f3k\u00e9, \"M\u00e1solni\"-t haszn\u00e1l). A ukr\u00e1n \u00e9s belorusz lokaliz\u00e1ci\u00f3kban is a \"M\u00e1solni\"-t haszn\u00e1lj\u00e1k. Emellett a nyelv nem statikus, folyamatosan fejl\u0151dik \u00e9s v\u00e1ltozik, a szab\u00e1lyai pedig a nyelvet besz\u00e9l\u0151k t\u00f6bbs\u00e9g\u00e9hez igazodnak.<\/a>, hogy ezt a probl\u00e9m\u00e1t kernel friss\u00edt\u00e9ssel \u00e9s a jav\u00edtott kernelbe val\u00f3 \u00fajraind\u00edt\u00e1ssal kell orvosolni.<\/p>\n

<\/noindex> <\/p>\n

A k\u00f6zz\u00e9tett demonstr\u00e1ci\u00f3s t\u00e1rol\u00f3 a Raspberry Pi OS Bookwormr\u00f3l k\u00e9sz\u00fclt ellen\u0151rz\u00e9st tartalmaz 6.12.75-\u00f6s kernel verzi\u00f3val, Debian 13, Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04, Arch \u00e9s CentOS 9 rendszereken. Ezt a list\u00e1t a PoC szerz\u0151j\u00e9nek adatak\u00e9nt kell kezelni, nem pedig kimer\u00edt\u0151 felsorol\u00e1sk\u00e9nt: mivel a hiba a kernel \u00e1ltal\u00e1nos logik\u00e1j\u00e1ban tal\u00e1lhat\u00f3, a t\u00e9nyleges lefedetts\u00e9g a kernel verzi\u00f3j\u00e1t\u00f3l \u00e9s az adott disztrib\u00faci\u00f3ban el\u00e9rhet\u0151 backport jav\u00edt\u00e1st\u00f3l f\u00fcgg.<\/p>\n

Adminisztr\u00e1torok sz\u00e1m\u00e1ra az alapvet\u0151 aj\u00e1nl\u00e1s egyszer\u0171: telep\u00edtsenek friss\u00edtett kernel csomagot a disztrib\u00faci\u00f3jukb\u00f3l \u00e9s ind\u00edts\u00e1k \u00fajra a rendszert. Ha van ok arra gondolni, hogy a g\u00e9pen m\u00e1r volt helyi, nem privilegiz\u00e1lt hozz\u00e1f\u00e9r\u00e9s a t\u00e1mad\u00f3t\u00f3l, a friss\u00edt\u00e9s ut\u00e1n \u00e9rdemes tov\u00e1bbi l\u00e9p\u00e9seket is megfontolni, mint az SSH host kulcsok rot\u00e1ci\u00f3ja \u00e9s az \/etc\/shadow \/fi\u00f3kok ellen\u0151rz\u00e9se, mivel mag\u00e1nak a sebezhet\u0151s\u00e9gnek a l\u00e9nyege \u00e9ppen a szenzit\u00edv f\u00e1jlok olvas\u00e1s\u00e1ban rejlik, nem csup\u00e1n a hozz\u00e1f\u00e9r\u00e9s ellen\u0151rz\u00e9s\u00e9nek absztrakt megker\u00fcl\u00e9s\u00e9ben.<\/p>\n

A Debian m\u00e1r elkezdte a jav\u00edt\u00e1s \u00e1t\u00fcltet\u00e9s\u00e9t: Baumann bejelentette a cherry-pick upstream commitot a trixie-fastforward-backports-ba \u00e9s elk\u00fcldte a merge k\u00e9rd\u00e9st a Debian sid-nek. A merge k\u00e9r\u00e9sben kifejezetten fel van t\u00fcntetve, hogy a 31e62c2 commitot a dumpability ptrace logik\u00e1j\u00e1nak jav\u00edt\u00e1sa \u00e9rdek\u00e9ben viszik \u00e1t, amely lehet\u0151v\u00e9 teszi, hogy a nem privilegiz\u00e1lt felhaszn\u00e1l\u00f3 olvassa a root f\u00e1jlokat.<\/p>\n

Forr\u00e1s: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0447\u0438\u0442\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e root, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 SSH host-\u043a\u043b\u044e\u0447\u0438 \u0438, \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445, \/etc\/shadow. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 CVE \u0434\u043b\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0435\u0449\u0451 \u043d\u0435 \u0431\u044b\u043b \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d. \u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435, \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043d\u0435 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 OpenSSH \u043a\u0430\u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172668","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47The ssh-keysign-pwn vulnerability in Linux has been closed, allowing local users to read root files | ProHoster","description":"A Linux kernel vulnerability has been fixed, unofficially named ssh-keysign-pwn.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c ssh-keysign-pwn, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0447\u0438\u0442\u0430\u0442\u044c root-\u0444\u0430\u0439\u043b\u044b | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-19T04:24:52+00:00","article:modified_time":"2026-05-19T10:52:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/172668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=172668"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/172668\/revisions"}],"predecessor-version":[{"id":172737,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/172668\/revisions\/172737"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=172668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=172668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=172668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}