{"id":170523,"date":"2026-05-08T12:24:30","date_gmt":"2026-05-08T10:24:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux"},"modified":"2026-05-08T12:24:30","modified_gmt":"2026-05-08T10:24:30","slug":"uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux","title":{"rendered":"Vulnerabilidades Dirty Frag, que alteram o cache de p\u00e1ginas para obter acesso root em qualquer distribui\u00e7\u00e3o Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

No n\u00facleo do Linux, foram identificadas duas vulnerabilidades, que s\u00e3o essencialmente an\u00e1logas \u00e0 vulnerabilidade Copy Fail revelada h\u00e1 alguns dias, mas que se manifestam em diferentes subsistemas \u2014 xfrm-ESP e RxRPC. As s\u00e9ries de vulnerabilidades receberam o codinome Dirty Frag (tamb\u00e9m \u00e9 mencionada como Copy Fail 2). Essas vulnerabilidades permitem que um usu\u00e1rio n\u00e3o privilegiado obtenha permiss\u00f5es de root, sobrescrevendo dados do processo no cache de p\u00e1ginas. Um exploit est\u00e1 dispon\u00edvel, funcionando em todas as distribui\u00e7\u00f5es atuais do Linux. As informa\u00e7\u00f5es sobre a vulnerabilidade foram divulgadas antes da publica\u00e7\u00e3o das corre\u00e7\u00f5es, mas h\u00e1 um m\u00e9todo alternativo para bloquear o problema. <\/p>\n

Dirty Frag abrange duas vulnerabilidades diferentes: a primeira no m\u00f3dulo xfrm-ESP, usado para acelerar opera\u00e7\u00f5es de criptografia no IPsec utilizando o protocolo ESP (Encapsulating Security Payload), e a segunda no driver RxRPC, que implementa a fam\u00edlia de sockets AF_RXRPC e o protocolo RPC hom\u00f4nimo, funcionando sobre UDP. Cada uma das vulnerabilidades, separadamente, permite a obten\u00e7\u00e3o de permiss\u00f5es de root. A vulnerabilidade no xfrm-ESP se manifesta no n\u00facleo do Linux desde janeiro de 2017, enquanto a vulnerabilidade no RxRPC est\u00e1 presente desde junho de 2023. Ambos os problemas s\u00e3o causados por otimiza\u00e7\u00f5es que permitem grava\u00e7\u00e3o direta no cache de p\u00e1ginas. <\/p>\n

Para explorar a vulnerabilidade no xfrm-ESP, o usu\u00e1rio deve ter permiss\u00f5es para criar espa\u00e7os de nomes, e para explorar a vulnerabilidade no RxRPC, deve ter a capacidade de carregar o m\u00f3dulo do n\u00facleo rxrpc.ko. Por exemplo, no Ubuntu, as regras do AppArmor pro\u00edbem que um usu\u00e1rio n\u00e3o privilegiado crie espa\u00e7os de nomes, mas por padr\u00e3o o m\u00f3dulo rxrpc.ko \u00e9 carregado. Em algumas distribui\u00e7\u00f5es, o m\u00f3dulo rxrpc.ko est\u00e1 ausente, mas n\u00e3o \u00e9 bloqueada a cria\u00e7\u00e3o de espa\u00e7os de nomes. O pesquisador que identificou o problema preparou um exploit combinado, capaz de atacar o sistema atrav\u00e9s de ambas as vulnerabilidades, permitindo explorar o problema em todas as principais distribui\u00e7\u00f5es. A opera\u00e7\u00e3o do exploit foi confirmada no Ubuntu 24.04.4 com o n\u00facleo 6.17.0-23, RHEL 10.1 com o n\u00facleo 6.12.0-124.49.1, openSUSE Tumbleweed com o n\u00facleo 7.0.2-1, CentOS Stream 10 com o n\u00facleo 6.12.0-224, AlmaLinux 10 com o n\u00facleo 6.12.0-124.52.3 e Fedora 44 com o n\u00facleo 6.19.14-300. <\/p>\n

Assim como na vulnerabilidade Copy Fail, os problemas no xfrm-ESP e RxRPC s\u00e3o causados pela execu\u00e7\u00e3o da descriptografia de dados no local, utilizando a fun\u00e7\u00e3o splice(), que transfere dados entre descritores de arquivos e pipes sem copiar, atrav\u00e9s da passagem de refer\u00eancias a elementos no cache de p\u00e1ginas. Os deslocamentos para a opera\u00e7\u00e3o de grava\u00e7\u00e3o foram calculados sem as devidas verifica\u00e7\u00f5es, que considerariam o uso de uma refer\u00eancia direta a elementos no cache de p\u00e1ginas, permitindo que, atrav\u00e9s do envio de solicita\u00e7\u00f5es especialmente formatadas, 4 bytes em um deslocamento escolhido fossem sobrescritos e o conte\u00fado do arquivo armazenado no cache de p\u00e1ginas fosse alterado. <\/p>\n

Todas as opera\u00e7\u00f5es de leitura a partir de arquivos, em primeiro lugar, retornam o conte\u00fado do cache de p\u00e1ginas. No caso de modifica\u00e7\u00e3o dos dados no cache de p\u00e1ginas, as opera\u00e7\u00f5es de leitura de arquivo resultar\u00e3o na devolu\u00e7\u00e3o de informa\u00e7\u00f5es que n\u00e3o est\u00e3o realmente armazenadas no dispositivo, mas de dados substitu\u00eddos. A explora\u00e7\u00e3o da vulnerabilidade se resume \u00e0 altera\u00e7\u00e3o do cache de p\u00e1ginas para um arquivo execut\u00e1vel com a bandeira suid root. Por exemplo, para obter permiss\u00f5es de root, pode-se ler o arquivo execut\u00e1vel \/usr\/bin\/su para coloc\u00e1-lo no cache de p\u00e1ginas, ap\u00f3s o que se pode injetar seu pr\u00f3prio c\u00f3digo no conte\u00fado desse arquivo, que foi carregado no cache de p\u00e1ginas. A execu\u00e7\u00e3o subsequente da utilidade 'su' resultar\u00e1 no carregamento na mem\u00f3ria de uma c\u00f3pia alterada do arquivo execut\u00e1vel do cache de p\u00e1ginas, em vez da vers\u00e3o original armazenada no dispositivo. <\/p>\n

A divulga\u00e7\u00e3o de informa\u00e7\u00f5es sobre vulnerabilidades e o lan\u00e7amento coordenado de atualiza\u00e7\u00f5es para resolver os problemas estavam previstos para 12 de maio, mas devido ao vazamento de informa\u00e7\u00f5es, os detalhes sobre a vulnerabilidade tiveram que ser publicados antes da libera\u00e7\u00e3o das corre\u00e7\u00f5es. No final de abril, patches para rxrpc, ipsec e xfrm foram publicados na lista de discuss\u00e3o p\u00fablica netdev, sem mencionar que estavam relacionados \u00e0 resolu\u00e7\u00e3o da vulnerabilidade. Em 5 de maio, o mantenedor do subsistema IPsec aceitou em seu reposit\u00f3rio git netdev uma altera\u00e7\u00e3o com uma corre\u00e7\u00e3o proposta no m\u00f3dulo xfrm-esp, cuja descri\u00e7\u00e3o repetia em grande parte a descri\u00e7\u00e3o do problema que levou \u00e0 vulnerabilidade Copy Fail no m\u00f3dulo algif_aead. Um dos pesquisadores de seguran\u00e7a se interessou por essa corre\u00e7\u00e3o, conseguiu criar um exploit funcional e o publicou, sem saber que havia um embargo sobre a divulga\u00e7\u00e3o da quest\u00e3o at\u00e9 12 de maio. <\/p>\n

Atualiza\u00e7\u00f5es com corre\u00e7\u00f5es para o n\u00facleo do Linux e pacotes do n\u00facleo nas distribui\u00e7\u00f5es ainda n\u00e3o foram publicadas, mas patches que resolvem problemas est\u00e3o dispon\u00edveis \u2014 xfrm-esp e rxrpc. Os identificadores CVE n\u00e3o foram atribu\u00eddos, o que dificulta o rastreamento da atualiza\u00e7\u00e3o dos pacotes nas distribui\u00e7\u00f5es. Como solu\u00e7\u00e3o alternativa para prote\u00e7\u00e3o, voc\u00ea pode bloquear o carregamento dos m\u00f3dulos do n\u00facleo esp4, esp6 e rxrpc: sh -c 'printf 'install esp4 \/bin\/false\\ninstall esp6 \/bin\/false\\ninstall rxrpc \/bin\/false\\n' > \/etc\/modprobe.d\/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>\/dev\/null; true'
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u0443\u0442\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail, \u043d\u043e \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 — xfrm-ESP \u0438 RxRPC. \u0421\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Dirty Frag (\u0442\u0430\u043a\u0436\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 Copy Fail 2). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170523","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilidades Dirty Frag, que alteram o cache de p\u00e1ginas para obter acesso root em quaisquer distribui\u00e7\u00f5es Linux | ProHoster","description":"Duas vulnerabilidades foram identificadas no n\u00facleo Linux, essencialmente an\u00e1logas \u00e0 vulnerabilidade Copy Fail revelada alguns dias atr\u00e1s, mas manifestando-se em outros subsistemas - xfrm-ESP e RxRPC.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Dirty Frag, \u0438\u0437\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043a\u044d\u0448 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root \u0432 \u043b\u044e\u0431\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e \u0441\u0432\u043e\u0435\u0439 \u0441\u0443\u0442\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u043d\u0435\u0439 \u043d\u0430\u0437\u0430\u0434 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail, \u043d\u043e \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u0432 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 - xfrm-ESP \u0438 RxRPC.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimosti-dirty-frag-izmenyayushhie-stranichnyj-kesh-dlya-polucheniya-root-v-lyubyh-distributivah-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-08T10:24:30+00:00","article:modified_time":"2026-05-08T10:24:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/170523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=170523"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/170523\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=170523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=170523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=170523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}