{"id":170863,"date":"2026-05-18T12:24:54","date_gmt":"2026-05-18T10:24:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root"},"modified":"2026-05-18T12:24:54","modified_gmt":"2026-05-18T10:24:54","slug":"v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","title":{"rendered":"A fost descoperit\u0103 o nou\u0103 vulnerabilitate LPE \u00een Linux, numit\u0103 Fragnesia, care permite unui utilizator local s\u0103 ob\u021bin\u0103 privilegii de root.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O kernel Linux a dezv\u0103luit o nou\u0103 vulnerabilitate de escaladare local\u0103 a privilegiilor, denumit\u0103 Fragnesia<\/strong> \u0219i identificat\u0103 prin CVE-2026-46300<\/strong>. Problema se \u00eencadreaz\u0103 \u00een aceea\u0219i clas\u0103 de atacuri asupra cache-ului de pagin\u0103, ca \u0219i Copy Fail \u0219i Dirty Frag discutate recent, dar nu este o re-publicare a unei erori anterioare: este vorba despre un defect distinct \u00een codul XFRM ESP-in-TCP<\/strong>.<\/p>\n

Vulnerabilitatea a fost descoperit\u0103 de cercet\u0103torul William Bowling<\/strong> din echipa V12 Security<\/strong>. Conform descrierii publicate, Fragnesia permite unui utilizator local f\u0103r\u0103 privilegii s\u0103 modifice con\u021binutul fi\u0219ierelor accesibile doar \u00een citire, \u00een memoria cache-ului de pagin\u0103 \u0219i, prin aceasta, s\u0103 execute cod cu drepturi de root. Spre deosebire de multe vechi exploat\u0103ri LPE, atacul nu necesit\u0103 o competi\u021bie \u0219i este descris de cercet\u0103tori ca fiind determinist.<\/p>\n

Tehnic, problema este legat\u0103 de faptul c\u0103, la combinarea bufferelor de re\u021bea, kernelul ar fi putut pierde semnul c\u0103 un fragment de date este \u201ecomun\u201d \u0219i legat de o pagin\u0103 extern\u0103 de memorie, inclusiv cu cache-ul de pagin\u0103. \u00cen patch-ul propus, aceasta este descris\u0103 ca o eroare \u00een skb_try_coalesce(): atunci c\u00e2nd fragmentele paginated erau mutate dintr-un sk_buff \u00een altul, nu se p\u0103stra steagul SKBFL_SHARED_FRAG. Ca urmare, codul ESP ulterior ar putea considera \u00een mod eronat bufferul ca fiind sigur pentru modificare.<\/p>\n

Efectul practic const\u0103 \u00een faptul c\u0103 datele, care au fost anterior plasate \u00een coada TCP dintr-un fi\u0219ier, dup\u0103 comutarea socket-ului \u00een modul espintcp, ar putea fi procesate de kernel ca text criptat ESP. La decriptarea AES-GCM, octe\u021bii erau modifica\u021bi direct \u00een pagina cache-ului de pagin\u0103 asociat\u0103 cu fi\u0219ierul. Aceasta nu schimb\u0103 fi\u0219ierul de pe disc, dar \u00eei schimb\u0103 reprezentarea \u00een memorie p\u00e2n\u0103 la \u00eenlocuirea paginii din cache.<\/p>\n

\u00cen demonstrarea publicat\u0103 a atacului, ca \u021bint\u0103 a fost utilizat \/usr\/bin\/su: exploit-ul a modificat primii octe\u021bi ai fi\u0219ierului binar \u00een cache-ul de pagin\u0103 \u0219i apoi a executat o copie modificat\u0103 \u00een memorie, ob\u021bin\u00e2nd un shell cu drepturi de root. Fi\u0219ierul original de pe disc r\u0103m\u00e2ne neschimbat, ceea ce face problema deosebit de nepl\u0103cut\u0103 pentru diagnosticare: urmele exploat\u0103rii pot disp\u0103rea dup\u0103 cur\u0103\u021barea cache-ului de pagin\u0103 sau dup\u0103 repornire.<\/p>\n

Fragnesia a ap\u0103rut \u00een mai pu\u021bin de o s\u0103pt\u0103m\u00e2n\u0103 dup\u0103 Dirty Frag. \u00cen V12 se subliniaz\u0103 c\u0103 este o alt\u0103 eroare \u00een aceea\u0219i suprafa\u021b\u0103 de atac \u2014 ESP\/XFRM \u2014 \u0219i nu o redenumire a unei vulnerabilit\u0103\u021bi deja corectate. Phoronix men\u021bioneaz\u0103, de asemenea, c\u0103, la momentul public\u0103rii, un proof-of-concept era disponibil, iar corectarea reprezenta un mic patch pentru net\/core\/skbuff.c, care nu a fost imediat integrat \u00een ramurile principale ale nucleului.<\/p>\n

<\/p>\n

Canonical a acordat CVE-2026-46300<\/a> prioritate ridicat\u0103 pentru Ubuntu, motiv\u00e2nd c\u0103 este o \u00abescaladare trivial\u0103 a privilegiilor locale\u00bb. Pe pagina de securitate Ubuntu pentru nucleele afectate, la momentul actualiz\u0103rii din 13 mai, statutul era \u00abNecesit\u0103 evaluare\u00bb, iar \u00eentr-o not\u0103 separat\u0103 se men\u021bioneaz\u0103 c\u0103 problema se afl\u0103, de asemenea, \u00een modulul ESP al nucleului \u0219i poate fi atenuat\u0103 temporar \u00een acela\u0219i mod ca \u0219i Dirty Frag.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Debian Security Tracker<\/a> la momentul verific\u0103rii marca nucleele din ramurile bullseye, bookworm, trixie, forky \u0219i sid ca vulnerabile; pentru pachetul linux \u00een unstable, versiunea fixat\u0103 \u00eenc\u0103 nu a fost specificat\u0103.<\/p>\n

<\/noindex> <\/p>\n

M\u0103sura temporar\u0103 de protec\u021bie r\u0103m\u00e2ne aceea\u0219i ca pentru Dirty Frag: dezactivarea \u00eenc\u0103rc\u0103rii modulelor<\/a> esp4, esp6 \u0219i rxrpc, dac\u0103 nu sunt necesare sistemului. Aceasta poate afecta func\u021bionarea tunelurilor IPsec pe nodurile unde se utilizeaz\u0103 kernel ESP, strongSwan, Libreswan sau configura\u021bii similare, a\u0219a c\u0103 pe gateway-urile VPN, aceast\u0103 m\u0103sur\u0103 ar trebui aplicat\u0103 doar dup\u0103 evaluarea consecin\u021belor.<\/p>\n

<\/noindex> <\/p>\n

Un exemplu de atenuare temporar\u0103 pentru administratori:<\/p>\n

sudo sh -c \"printf 'install esp4 \/bin\/falseninstall esp6 \/bin\/falseninstall rxrpc \/bin\/falsen' > \/etc\/modprobe.d\/dirtyfrag.conf\" sudo rmmod esp4 esp6 rxrpc 2>\/dev\/null || true <\/p>\n

Dac\u0103 exist\u0103 suspiciuni c\u0103 sistemul ar fi putut fi atacat, blocarea modulelor nu este suficient\u0103: deoarece demonstrarea public\u0103 schimb\u0103 fi\u0219ierul executabil chiar \u00een cache-ul paginilor, administratorii recomand\u0103 cur\u0103\u021barea cache-ului paginilor sau repornirea sistemului dup\u0103 aplicarea m\u0103surilor de protec\u021bie. CloudLinux subliniaz\u0103 c\u0103 dup\u0103 exploatarea \/usr\/bin\/su, acesta poate r\u0103m\u00e2ne modificat \u00een memorie p\u00e2n\u0103 la eliminarea paginilor corespunz\u0103toare.<\/p>\n

Pentru a elimina regula temporar\u0103 dup\u0103 instalarea nucleului corectat, se poate \u0219terge fi\u0219ierul creat:<\/p>\n

sudo rm \/etc\/modprobe.d\/dirtyfrag.conf <\/p>\n

Recomandarea principal\u0103 r\u0103m\u00e2ne standard: instala\u021bi nucleul corectat de la distribu\u021bia dvs. \u0219i reporni\u021bi sistemul. P\u00e2n\u0103 la actualizare, cel mai mare risc este reprezentat de serverele multiutilizator, CI runners, hosting partajat, ferme de build cu containere \u0219i orice ma\u0219ini unde utilizatorii neprivilegia\u021bi sau par\u021bial de \u00eencredere pot executa cod local.<\/p>\n

Sursa: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Fragnesia \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2026-46300. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 page cache, \u0447\u0442\u043e \u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u0432\u0448\u0438\u0435\u0441\u044f Copy Fail \u0438 Dirty Frag, \u043d\u043e \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0441\u0442\u0430\u0440\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438: \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043e\u0431 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u043c \u0434\u0435\u0444\u0435\u043a\u0442\u0435 \u0432 \u043a\u043e\u0434\u0435 XFRM ESP-in-TCP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c William Bowling […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170863","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A fost descoperit\u0103 o nou\u0103 vulnerabilitate LPE Fragnesia \u00een Linux, care permite utilizatorilor locali s\u0103 ob\u021bin\u0103 acces root | ProHoster","description":"\u00cen kernelul Linux a fost descoperit\u0103 o nou\u0103 vulnerabilitate de escaladare a privilegiilor locale, denumit\u0103 Fragnesia \u0219i identificat\u0103 prin CVE-2026-46300.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Fragnesia, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Fragnesia \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2026-46300.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T10:24:54+00:00","article:modified_time":"2026-05-18T10:24:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/170863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=170863"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/170863\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=170863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=170863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=170863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}