{"id":181735,"date":"2026-05-25T20:48:34","date_gmt":"2026-05-25T18:48:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root"},"modified":"2026-05-25T20:48:34","modified_gmt":"2026-05-25T18:48:34","slug":"gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","title":{"rendered":"GRO Frag: nova vulnerabilidade LPE no stack de rede do Linux permite acesso root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>      <noindex><\/p>\n<p>Um exploit para <strong>GRO Frag<\/strong> \u2014 uma vulnerabilidade local de eleva\u00e7\u00e3o de privil\u00e9gios no n\u00facleo do Linux, relacionada ao processamento de GRO e skb zero-copy no stack de rede. <strong>A data exata da descoberta inicial nos materiais p\u00fablicos n\u00e3o est\u00e1 indicada<\/strong>. Com base em rastros abertos, \u00e9 poss\u00edvel registrar duas datas: a corre\u00e7\u00e3o foi discutida na lista de discuss\u00e3o netdev <strong>20 de maio de 2026<\/strong>, onde esta vulnerabilidade j\u00e1 foi descrita como apta a sobrescrever o cache de p\u00e1ginas, e um PoC p\u00fablico foi postado no <a rel=\"nofollow\" href=\"https:\/\/www.spinics.net\/lists\/netdev\/msg1189117.html\">GitHub Gist<\/a> <strong>22 de maio de 2026<\/strong>.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p>Como uma medida tempor\u00e1ria antes da instala\u00e7\u00e3o do n\u00facleo corrigido, pode-se limitar o vetor de ataque via sysctl: kernel.io_uring_disabled=1. Esse modo pro\u00edbe a cria\u00e7\u00e3o de novas inst\u00e2ncias de io_uring por processos n\u00e3o privilegiados, a menos que estejam na lista permitida io_uring_group; com o valor de grupo -1, o acesso \u00e9 concedido apenas a processos com CAP_SYS_ADMIN. Esta \u00e9 uma mitiga\u00e7\u00e3o, n\u00e3o uma corre\u00e7\u00e3o completa da vulnerabilidade.<\/p>\n<p>O problema reside na fun\u00e7\u00e3o skb_gro_receive(): ao agregar pacotes GRO, o n\u00facleo poderia mover fragmentos de skb zero-copy para outro skb sem verificar corretamente o estado de zero-copy e o sinal SKBFL_MANAGED_FRAG_REFS. Como resultado, as p\u00e1ginas de mem\u00f3ria, das quais o skb original n\u00e3o mantinha refer\u00eancias separadas, poderiam ser liberadas incorretamente, levando a um uso ap\u00f3s a libera\u00e7\u00e3o. O patch indica claramente que essa situa\u00e7\u00e3o pode levar a UAF, e que a variante encontrada era apta a sobrescrever o cache de p\u00e1ginas.<\/p>\n<p><noindex><\/p>\n<p>O PoC publicado descreve a vulnerabilidade como <strong>LPE atrav\u00e9s de GRO managed-frag UAF<\/strong> usando io_uring SEND_ZC e a interface de rede virtual veth. No coment\u00e1rio do c\u00f3digo est\u00e1 indicado que os n\u00facleos afetados s\u00e3o <strong>Linux 6.0+<\/strong>, a explora\u00e7\u00e3o \u00e9 poss\u00edvel por um usu\u00e1rio n\u00e3o privilegiado, mas requer acesso a io_uring; a corre\u00e7\u00e3o mencionada \u00e9 <a rel=\"nofollow\" href=\"https:\/\/gist.github.com\/lcfr-eth\/2566a5cef312c94a5ff8d62fa417955f\">o commit<\/a> 4db79a322db8 com a altera\u00e7\u00e3o \u00abnet: gro: n\u00e3o mesclar zcopy skbs\u00bb.<\/p>\n<p><\/noindex><br \/>\n<noindex><\/p>\n<p>Em termos de consequ\u00eancias, GRO Frag se encaixa na mesma classe perigosa de erros que Copy Fail e Dirty Frag: um atacante com acesso local n\u00e3o privilegiado consegue alterar dados no cache de p\u00e1ginas, ou seja, na mem\u00f3ria, sem modifica\u00e7\u00e3o obrigat\u00f3ria do arquivo no disco. Esses erros s\u00e3o especialmente indesej\u00e1veis, pois afetam a fronteira entre o arquivo \"somente leitura\" e o conte\u00fado real que o n\u00facleo e os processos veem em acessos posteriores. Elastic <a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/security-labs\/copy-fail-dirtyfrag-linux-page-bugs-in-the-wild\">j\u00e1 descreveu anteriormente<\/a> esta classe \u00e9 um caminho pr\u00e1tico para obter root atrav\u00e9s da corrup\u00e7\u00e3o do cache de p\u00e1gina.<\/p>\n<p><\/noindex><\/p>\n<p>No momento da publica\u00e7\u00e3o, um identificador CVE separado para o GRO Frag, ao que parece, ainda n\u00e3o foi designado. Como medidas tempor\u00e1rias, os administradores devem considerar atualizar o n\u00facleo para uma vers\u00e3o com corre\u00e7\u00e3o, bem como adotar medidas gerais de mitiga\u00e7\u00e3o de riscos para tais LPE: limitar namespaces de usu\u00e1rios n\u00e3o privilegiados onde for admiss\u00edvel, controlar o uso do io_uring e monitorar cadeias suspeitas relacionadas \u00e0 escalada local de privil\u00e9gios. Para ataques relacionados a Copy Fail\/DirtyFrag, a Elastic tamb\u00e9m recomenda combinar patching com a detec\u00e7\u00e3o de primitivas de explora\u00e7\u00e3o de baixo n\u00edvel da vulnerabilidade.<\/p>\n<p>Primitivas de explora\u00e7\u00e3o de baixo n\u00edvel n\u00e3o s\u00e3o o \"hack completo\", mas sim t\u00e9cnicas t\u00e9cnicas b\u00e1sicas que constituem um exploit.<\/p>\n<p>No contexto do GRO Frag, isso pode significar n\u00e3o detectar o fato j\u00e1 consumado de que \"o usu\u00e1rio se tornou root\", mas sim tentar notar a\u00e7\u00f5es suspeitas individuais que o exploit utiliza ao longo do caminho para a eleva\u00e7\u00e3o de privil\u00e9gios.<\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18300059\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435. \u0422\u043e\u0447\u043d\u0430\u044f \u0434\u0430\u0442\u0430 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430\u0445 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u0430. \u041f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0441\u043b\u0435\u0434\u0430\u043c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0435 \u0434\u0430\u0442\u044b: \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u043b\u043e\u0441\u044c \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 netdev 20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430, \u0433\u0434\u0435 \u0434\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181735","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47GRO Frag: \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435 Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-25T18:48:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-25T18:48:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47GRO Frag: nova vulnerabilidade LPE na pilha de rede do Linux permite obter root | ProHoster","description":"Um exploit para o GRO Frag \u2014 uma vulnerabilidade local de eleva\u00e7\u00e3o de privil\u00e9gios no n\u00facleo Linux, relacionada ao processamento de GRO e skb zero-copy na pilha de rede \u2014 foi tornado p\u00fablico.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GRO Frag: \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435 Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-25T18:48:34+00:00","article:modified_time":"2026-05-25T18:48:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/181735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=181735"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/181735\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=181735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=181735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=181735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}