{"id":172665,"date":"2026-05-19T00:24:34","date_gmt":"2026-05-18T22:24:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-19T00:24:34","modified_gmt":"2026-05-18T22:24:34","slug":"dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"DirtyDecrypt \u2014 o nou\u0103 vulnerabilitate din clasa Copy Fail, care ofer\u0103 drepturi de root \u00een Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Okernel Linux a fost identificat\u0103 o vulnerabilitate similar\u0103 cu vulnerabilit\u0103\u021bile Copy Fail, Dirty Frag \u0219i Fragnesia, care permite unui utilizator f\u0103r\u0103 privilegii s\u0103 ob\u021bin\u0103 drepturi de root prin rescrierea datelor din memoria cache a paginilor. Vulnerabilit\u0103\u021bii i s-a dat numele de cod DirtyDecrypt (problema este, de asemenea, men\u021bionat\u0103 sub numele DirtyCBC). Un prototip de exploit este disponibil. <\/p>\n

Identificatorul CVE nu este men\u021bionat \u00een notele exploitului, fiind specificat doar c\u0103 cercet\u0103torii au identificat problema pe 9 mai, dup\u0103 care au informat dezvoltatorii kernel-ului, care au r\u0103spuns c\u0103 descoperirea lor duplicateaz\u0103 un alt raport despre o vulnerabilitate deja reparat\u0103. Deoarece patch-ul cu corec\u021bia a fost deja inclus \u00een kernel, cercet\u0103torii au decis s\u0103 publice exploit-ul dezvoltat de ei. Judec\u00e2nd dup\u0103 descrierea din interiorul exploit-ului, acesta folose\u0219te vulnerabilitatea CVE-2026-31635, corectarea c\u0103reia a fost acceptat\u0103 \u00een kernel \u00een aprilie \u0219i a fost inclus\u0103 \u00een ramura 7.0.0 \u0219i \u00een versiunea 6.18.23, format\u0103 pe 18 aprilie. Problema apare \u00eencep\u00e2nd cu kernel-ul 6.16. <\/p>\n

La fel ca \u00een cazul seriei de vulnerabilit\u0103\u021bi Dirty Frag, noua vulnerabilitate este prezent\u0103 \u00een driverul RxRPC, care implementeaz\u0103 familia de socket-uri AF_RXRPC \u0219i protocolul RPC omonim, care func\u021bioneaz\u0103 pe baza UDP. Problema este cauzat\u0103 de o eroare \u00een verificarea dimensiunii datelor \u00een func\u021bia rxgk_verify_response() - \u00een loc de verificarea 'if (auth_len > len)', \u00een cod era specificat 'if (auth_len < len)', ceea ce ducea la transmiterea func\u021biei rxgk_decrypt_skb() a datelor cu o dimensiune mai mare dec\u00e2t cea permis\u0103. \u00cen timpul execu\u021biei func\u021biei rxgk_decrypt_skb(), decriptarea datelor se realiza prin inserarea modific\u0103rilor direct \u00een cache-ul pe pagin\u0103 pentru a exclude tamponarea inutil\u0103. Din cauza verific\u0103rii incorecte a dimensiunii, exista posibilitatea de a suprascrie datele \u00een cache-ul pe pagin\u0103 la un offset ales. <\/p>\n

Exploatarea vulnerabilit\u0103\u021bii const\u0103 \u00een citirea fi\u0219ierului programului cu flag-ul suid root (pentru a-l \u00eenc\u0103rca \u00een cache-ul pe pagin\u0103) \u0219i \u00eenlocuirea \u00een cache-ul pe pagin\u0103 a unei p\u0103r\u021bi a codului programului cu codul pentru a executa \/usr\/bin\/sh. Rularea ulterioar\u0103 a programului va duce la \u00eenc\u0103rcarea \u00een memorie a unei copii modificate din cache-ul pe pagin\u0103, nu a fi\u0219ierului executabil original de pe suport. Ca programe suid, exploatarea prevede utilizarea '\/usr\/bin\/su', '\/bin\/su', '\/usr\/bin\/mount', '\/usr\/bin\/passwd' \u0219i '\/usr\/bin\/chsh'. <\/p>\n

Pentru exploatarea vulnerabilit\u0103\u021bii \u00een cadrul compil\u0103rii kernelului, op\u021biunea CONFIG_RXGK trebuie s\u0103 fie activ\u0103, iar pentru \u00eenc\u0103rcarea automat\u0103 trebuie s\u0103 fie disponibil modulul kernel rxrpc.ko (\u00een unele sisteme, acesta nu este compilat). Statusul remedierii vulnerabilit\u0103\u021bilor \u00een distribu\u021bii poate fi evaluat pe aceste pagini: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Arch, Fedora. Ca o ocolire de protec\u021bie, se poate bloca \u00eenc\u0103rcarea modulului kernel rxrpc: <\/p>\n

sh -c 'printf 'install rxrpc \/bin\/false\n' > \/etc\/modprobe.d\/dirtydecrypt.conf; rmmod rxrpc 2>\/dev\/null; true' <\/p>\n

\u00cen plus, se poate men\u021biona publicarea \u00een lista de discu\u021bii a dezvoltatorilor kernel-ului Linux a patch-urilor care dezactiveaz\u0103 complet \u00een API-ul crypto (AF_ALG) optimiz\u0103rile care utilizeaz\u0103 accesul direct la cache-ul pe pagin\u0103 \u00een timpul decript\u0103rii folosind algoritmii 'skcipher' \u0219i 'aead'. Optimiz\u0103rile excludeau tamponarea inutil\u0103 a datelor, dar creau riscuri de apari\u021bie a vulnerabilit\u0103\u021bilor grave. Se presupune c\u0103 dezactivarea acestora va duce doar la o diminuare nesemnificativ\u0103 a performan\u021bei datorit\u0103 apari\u021biei unei opera\u021bii suplimentare de copiere \u00eentr-un buffer separat. Patch-urile au fost acceptate de c\u0103tre mentinatorul subsistemului API crypto \u0219i incluse \u00een ramura 'cryptodev', \u00een care se dezvolt\u0103 capacit\u0103\u021bile pentru a fi incluse \u00een compunerea viitoarelor versiuni ale kernel-ului Linux.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Copy Fail, Dirty Frag \u0438 Fragnesia \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f DirtyDecrypt (\u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u0438\u043c\u0435\u043d\u0435\u043c DirtyCBC). \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0432 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0438 \u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0443 \u043d\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043e \u043b\u0438\u0448\u044c, \u0447\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 9 \u043c\u0430\u044f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DirtyDecrypt \u2014 o nou\u0103 vulnerabilitate din clasa Copy Fail, care ofer\u0103 drepturi root \u00een Linux | ProHoster","description":"O vulnerabilitate \u00een kernelul Linux a fost descoperit\u0103, similar\u0103 cu vulnerabilit\u0103\u021bile Copy Fail, Dirty Frag \u0219i Fragnesia, care permite unui utilizator f\u0103r\u0103 privilegii s\u0103 ob\u021bin\u0103 drepturi root prin suprascrierea datelor \u00een cache-ul paginilor.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DirtyDecrypt \u2014 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u0430 Copy Fail, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0430\u0432\u0430 root \u0432 Linux | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Copy Fail, Dirty Frag \u0438 Fragnesia \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T22:24:34+00:00","article:modified_time":"2026-05-18T22:24:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/172665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=172665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/172665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=172665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=172665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=172665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}