{"id":172665,"date":"2026-05-19T00:24:34","date_gmt":"2026-05-18T22:24:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-19T00:24:34","modified_gmt":"2026-05-18T22:24:34","slug":"dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"DirtyDecrypt \u2014 mais uma vulnerabilidade da classe Copy Fail, que concede privil\u00e9gios de root no Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Uma vulnerabilidade foi identificada no n\u00facleo do Linux, semelhante \u00e0s vulnerabilidades Copy Fail, Dirty Frag e Fragnesia, permitindo que um usu\u00e1rio n\u00e3o privilegiado obtenha privil\u00e9gios de root, reescrevendo dados no cache de p\u00e1ginas. A vulnerabilidade recebeu o codinome DirtyDecrypt (o problema tamb\u00e9m \u00e9 mencionado como DirtyCBC). Um prot\u00f3tipo do exploit est\u00e1 dispon\u00edvel. <\/p>\n

O identificador CVE n\u00e3o \u00e9 mencionado na nota do exploit, \u00e9 informado apenas que os pesquisadores descobriram o problema em 9 de maio, ap\u00f3s o que informaram os desenvolvedores do n\u00facleo, que responderam que a descoberta deles duplicava outro relat\u00f3rio sobre uma vulnerabilidade j\u00e1 corrigida. Como o patch com a corre\u00e7\u00e3o j\u00e1 foi inclu\u00eddo no n\u00facleo, os pesquisadores decidiram publicar o exploit que desenvolveram. Pelo que pode ser descrito no exploit, ele utiliza a vulnerabilidade CVE-2026-31635, cuja corre\u00e7\u00e3o foi aceita no n\u00facleo em abril e faz parte da vers\u00e3o 7.0.0, lan\u00e7ada em 18 de abril na vers\u00e3o 6.18.23. O problema se manifesta a partir do n\u00facleo 6.16. <\/p>\n

Assim como no caso da s\u00e9rie de vulnerabilidades Dirty Frag, a nova vulnerabilidade est\u00e1 presente no driver RxRPC, que implementa a fam\u00edlia de sockets AF_RXRPC e o protocolo RPC hom\u00f4nimo, funcionando sobre UDP. O problema \u00e9 causado por um erro na verifica\u00e7\u00e3o do tamanho dos dados na fun\u00e7\u00e3o rxgk_verify_response() \u2014 em vez de verificar 'if (auth_len > len)', o c\u00f3digo estava escrito como 'if (auth_len < len)', o que resultava na passagem para a fun\u00e7\u00e3o rxgk_decrypt_skb() de dados com um tamanho superior ao permitido. Ao executar a fun\u00e7\u00e3o rxgk_decrypt_skb(), a decodifica\u00e7\u00e3o dos dados era realizada substituindo as altera\u00e7\u00f5es diretamente no cache de p\u00e1gina para evitar um buffer extra. Devido \u00e0 verifica\u00e7\u00e3o incorreta do tamanho, havia a possibilidade de sobrescrever dados no cache de p\u00e1gina em um deslocamento escolhido. <\/p>\n

A explora\u00e7\u00e3o da vulnerabilidade se resume \u00e0 leitura de um arquivo de programa com a flag suid root (para que ele permane\u00e7a no cache de p\u00e1gina) e \u00e0 substitui\u00e7\u00e3o de parte do c\u00f3digo do programa no cache de p\u00e1gina por c\u00f3digo para executar \/usr\/bin\/sh. A execu\u00e7\u00e3o subsequente do programa far\u00e1 com que seja carregado na mem\u00f3ria n\u00e3o o arquivo execut\u00e1vel original do armazenamento, mas uma c\u00f3pia modificada do cache de p\u00e1gina. Entre os programas suid mencionados no exploit, est\u00e3o '\/usr\/bin\/su', '\/bin\/su', '\/usr\/bin\/mount', '\/usr\/bin\/passwd' e '\/usr\/bin\/chsh'. <\/p>\n

Para explorar a vulnerabilidade, a op\u00e7\u00e3o CONFIG_RXGK deve estar ativada na configura\u00e7\u00e3o do kernel, e o m\u00f3dulo do kernel rxrpc.ko deve estar dispon\u00edvel para inicializa\u00e7\u00e3o autom\u00e1tica (em alguns sistemas, ele n\u00e3o \u00e9 compilado). O status de corre\u00e7\u00e3o de vulnerabilidades nas distribui\u00e7\u00f5es pode ser avaliado nas seguintes p\u00e1ginas: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Arch, Fedora. Como medida de prote\u00e7\u00e3o alternativa, voc\u00ea pode bloquear a carga do m\u00f3dulo do kernel rxrpc: <\/p>\n

sh -c 'printf \"install rxrpc \/bin\/false\\n\" > \/etc\/modprobe.d\/dirtydecrypt.conf; rmmod rxrpc 2>\/dev\/null; true' <\/p>\n

Adicionalmente, pode-se notar a publica\u00e7\u00e3o na lista de discuss\u00f5es dos desenvolvedores do kernel Linux de patches que desativam completamente, no crypto API (AF_ALG), as otimiza\u00e7\u00f5es que utilizam acesso direto ao cache de p\u00e1gina ao decifrar usando os algoritmos 'skcipher' e 'aead'. As otimiza\u00e7\u00f5es excluem buffering extra de dados, mas criam riscos de s\u00e9rias vulnerabilidades. Acredita-se que sua desativa\u00e7\u00e3o resultar\u00e1 apenas em uma leve diminui\u00e7\u00e3o no desempenho devido \u00e0 opera\u00e7\u00e3o adicional de c\u00f3pia para um buffer separado. Os patches foram aceitos pelo mantenedor do subsistema crypto API e inclu\u00eddos na ramifica\u00e7\u00e3o 'cryptodev', que desenvolve recursos para inclus\u00e3o nas vers\u00f5es futuras do kernel Linux.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Copy Fail, Dirty Frag \u0438 Fragnesia \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f DirtyDecrypt (\u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u0438\u043c\u0435\u043d\u0435\u043c DirtyCBC). \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0432 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0438 \u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0443 \u043d\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043e \u043b\u0438\u0448\u044c, \u0447\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 9 \u043c\u0430\u044f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DirtyDecrypt \u2014 mais uma vulnerabilidade da classe Copy Fail, concedendo privil\u00e9gios de root no Linux | ProHoster","description":"Uma vulnerabilidade foi identificada no kernel Linux, an\u00e1loga \u00e0s vulnerabilidades Copy Fail, Dirty Frag e Fragnesia, que permite que um usu\u00e1rio n\u00e3o privilegiado obtenha privil\u00e9gios de root ao sobrescrever dados no cache de p\u00e1ginas.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DirtyDecrypt \u2014 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u0430 Copy Fail, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0430\u0432\u0430 root \u0432 Linux | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Copy Fail, Dirty Frag \u0438 Fragnesia \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T22:24:34+00:00","article:modified_time":"2026-05-18T22:24:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/172665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=172665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/172665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=172665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=172665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=172665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}