{"id":172668,"date":"2026-05-19T06:24:52","date_gmt":"2026-05-19T04:24:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly"},"modified":"2026-05-19T12:52:18","modified_gmt":"2026-05-19T10:52:18","slug":"v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","title":{"rendered":"O vulnerabilitate ssh-keysign-pwn a fost \u00eenchis\u0103 \u00een Linux, permi\u021b\u00e2nd utilizatorilor locali s\u0103 citeasc\u0103 fi\u0219ierele root.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O vulnerabilitate a fost corectat\u0103 \u00een nucleul Linux, av\u00e2nd un nume neoficial. ssh-keysign-pwn<\/strong>. Problema permite unui utilizator local f\u0103r\u0103 privilegii s\u0103 citeasc\u0103 fi\u0219iere care ar trebui s\u0103 fie accesibile doar lui root, inclusiv cheile private SSH host \u0219i, \u00een anumite scenarii, \/etc\/shadow. La momentul public\u0103rii, un CVE separat pentru problem\u0103 nu fusese \u00eenc\u0103 atribuit.<\/p>\n

<\/p>\n

\u00cen ciuda numelui, nu este vorba despre o eroare \u00een OpenSSH ca server de re\u021bea sshd, ci despre un defect<\/a> \u00een logica nucleului Linux, legat de verific\u0103rile ptrace \u0219i accesul la descriptorii de fi\u0219iere ai altui proces prin pidfd_getfd(2). Instrumentul ssh-keysign OpenSSH s-a dovedit a fi unul dintre exemplele convenabile de exploatare, deoarece lucreaz\u0103 cu cheile private host, care de obicei apar\u021bin lui root \u0219i nu sunt accesibile utilizatorilor obi\u0219nui\u021bi.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Esenta erorii<\/a> const\u0103 \u00een faptul c\u0103 func\u021bia __ptrace_may_access() trata incorect starea unui proces, al c\u0103rui spa\u021biu de memorie mm a disp\u0103rut deja, dar care \u00eenc\u0103 avea descriptorii de fi\u0219iere deschi\u0219i. \u00cen timpul \u00eencheierii procesului, nucleul apeleaz\u0103 exit_mm() mai devreme dec\u00e2t \u00eenchide fi\u0219ierele prin exit_files(). \u00cen acest interval scurt, procesul pare s\u0103 nu mai aib\u0103 un spa\u021biu de adres\u0103 de utilizator obi\u0219nuit, dar fi\u0219ierele sale deschise exist\u0103 \u00eenc\u0103. Din aceast\u0103 cauz\u0103, verificarea st\u0103rii \u201edumpable\u201d putea fi ocolit\u0103, iar pidfd_getfd() putea ob\u021bine acces la un descriptor de fi\u0219ier str\u0103in cu UID coincident.<\/p>\n

<\/noindex> <\/p>\n

Un scenariu practic se bazeaz\u0103 pe programe setuid, care mai \u00eent\u00e2i deschid un fi\u0219ier sensibil cu privilegii root, apoi \u00ee\u0219i pierd privilegiile \u0219i se \u00eencheie, av\u00e2nd \u00een continuare un descriptor deschis. \u00cen descrierea publicat\u0103, ca exemplu este men\u021bionat ssh-keysign: acesta deschide \/etc\/ssh\/ssh_host_{ecdsa,ed25519,rsa}_key, dup\u0103 care \u00ee\u0219i pierde drepturile \u0219i se poate \u00eencheia dac\u0103 EnableSSHKeysign este dezactivat. Aceste chei ar trebui s\u0103 fie accesibile doar lui root, deoarece sunt utilizate pentru autentificarea bazat\u0103 pe host.<\/p>\n

Exemplul doi este chage, care poate deschide \/etc\/shadow, apoi reseteaz\u0103 permisiunile efective \u0219i se finalizeaz\u0103. Ca urmare, atacul nu ofer\u0103 neap\u0103rat imediat un shell cu privilegii root, dar permite ob\u021binerea con\u021binutului fi\u0219ierelor care sunt de obicei considerate extrem de protejate. Scurgerea \/etc\/shadow este periculoas\u0103 prin posibilitatea ulterioar\u0103 a ghicirii offline a parolelor, iar scurgerea cheilor private SSH de gazd\u0103 reprezint\u0103 riscul de a \u00eenlocui gazda sau de a desf\u0103\u0219ura atacuri asupra scenariilor SSH de \u00eencredere.<\/p>\n

Corectarea a fost deja acceptat\u0103 \u00een ramura principal\u0103 Linux. Commitul 31e62c2ebbfd cu titlul ptrace: logic\u0103 pu\u021bin mai ra\u021bional\u0103 pentru 'get_dumpable()' schimb\u0103 comportamentul verific\u0103rii dumpability: nucleul acum p\u0103streaz\u0103 starea user_dumpable atunci c\u00e2nd mm dispare \u0219i necesit\u0103 o verificare corect\u0103 a CAP_SYS_PTRACE pentru a fi ocolit\u0103. Patch-ul afecteaz\u0103 include\/linux\/sched.h, kernel\/exit.c \u0219i kernel\/ptrace.c.<\/p>\n

Vulnerabilitatea a fost raportat\u0103 de Qualys \u0219i corectat\u0103 de Linus Torvalds pe 14 mai 2026. Phoronix observ\u0103 c\u0103, la momentul public\u0103rii, problema afecta toate versiunile nucleului Linux p\u00e2n\u0103 la starea actual\u0103 a arborelui mainline, \u00eenainte de aplicarea corect\u0103rii. Autorul PoC subliniaz\u0103 de asemenea c\u0103 sunt vulnerabile nucleele anterioare commit-ului 31e62c2ebbfd, inclusiv ramuri stabile la data de 14 mai.<\/p>\n

<\/p>\n

Este important de men\u021bionat c\u0103 pentru exploatare nu este necesar\u0103 \u00eenc\u0103rcarea modulelor specifice ale nucleului, a\u0219a cum s-a \u00eent\u00e2mplat \u00een cazul unor recente vulnerabilit\u0103\u021bi LPE. Este suficient accesul local f\u0103r\u0103 privilegii la sistem \u0219i existen\u021ba unui proces auxiliar cu privilegii adecvate. Dezvoltatorul Debian, Daniel Baumann, unul dintre voluntarii care sus\u021bin localizarea \u00een limba rus\u0103, varianta eronat\u0103 este mai r\u0103sp\u00e2ndit\u0103 \u0219i familiar\u0103 pentru majoritatea utilizatorilor (de exemplu, \u00een interfa\u021ba macOS, Apple folose\u0219te \u201e\u0421\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u201d, iar Microsoft \u00een Windows, utilizatorii c\u0103ruia sunt mult mai numero\u0219i dec\u00e2t utilizatorii macOS, folose\u0219te \u201e\u041a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u201d). \u00cen localiz\u0103rile ucrainene \u0219i belaruse se folose\u0219te de asemenea \u201e\u041a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u201d. \u00cen plus, limba nu este static\u0103, ea evolueaz\u0103 constant \u0219i se schimb\u0103, iar regulile ei se adapteaz\u0103 majorit\u0103\u021bii vorbitorilor.<\/a>, a men\u021bionat c\u0103 aceast\u0103 problem\u0103 ar trebui remediat\u0103 prin actualizarea nucleului \u0219i o repornire \u00een nucleul corectat.<\/p>\n

<\/noindex> <\/p>\n

\u00cen depozitul publicat cu demonstrarea a fost anun\u021bat\u0103 o verificare pe Raspberry Pi OS Bookworm cu nucleul 6.12.75, Debian 13, Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04, Arch \u0219i CentOS 9. Aceast\u0103 list\u0103 ar trebui considerat\u0103 ca datele autorului PoC, \u0219i nu ca o list\u0103 exhaustiv\u0103: deoarece eroarea se afl\u0103 \u00een logica general\u0103 a nucleului, acoperirea efectiv\u0103 depinde de versiunea nucleului \u0219i de existen\u021ba corect\u0103rilor backport pentru distribu\u021bia specific\u0103.<\/p>\n

Pentru administratori, recomandarea principal\u0103 este simpl\u0103: instala\u021bi pachetul de kernel actualizat de la distribu\u021bia dvs. \u0219i reporni\u021bi sistemul. Dac\u0103 ave\u021bi motive s\u0103 crede\u021bi c\u0103 pe ma\u0219in\u0103 a existat deja un acces local neprivilegiat din partea unui atacator, dup\u0103 actualizare ar trebui s\u0103 lua\u021bi \u00een considerare rotirea cheilor host SSH \u0219i verificarea conturilor din \/etc\/shadow, deoarece vulnerabilitatea \u00een sine este legat\u0103 de citirea fi\u0219ierelor sensibile, nu doar de o simpl\u0103 ocolire a verific\u0103rii accesului.<\/p>\n

\u00cen Debian a \u00eenceput deja lucrul pentru migrarea remedierii: Baumann a raportat despre cherry-pick-ul unui commit upstream \u00een trixie-fastforward-backports \u0219i despre trimiterea unei cereri de fuziune pentru Debian sid. \u00cen cererea de fuziune este specificat clar c\u0103 se migreaz\u0103 commit-ul 31e62c2 pentru corectarea logicii dumpabilit\u0103\u021bii ptrace, care permite citirea fi\u0219ierelor root de c\u0103tre utilizatori neprivilegia\u021bi.<\/p>\n

Sursa: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0447\u0438\u0442\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e root, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 SSH host-\u043a\u043b\u044e\u0447\u0438 \u0438, \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445, \/etc\/shadow. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 CVE \u0434\u043b\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0435\u0449\u0451 \u043d\u0435 \u0431\u044b\u043b \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d. \u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435, \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043d\u0435 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 OpenSSH \u043a\u0430\u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172668","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitatea ssh-keysign-pwn a fost \u00eenchis\u0103 \u00een Linux, permi\u021b\u00e2nd utilizatorilor locali s\u0103 citeasc\u0103 fi\u0219iere root | ProHoster","description":"O vulnerabilitate a kernel-ului Linux a fost corectat\u0103, primind denumirea neoficial\u0103 de ssh-keysign-pwn.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c ssh-keysign-pwn, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0447\u0438\u0442\u0430\u0442\u044c root-\u0444\u0430\u0439\u043b\u044b | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-19T04:24:52+00:00","article:modified_time":"2026-05-19T10:52:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/172668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=172668"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/172668\/revisions"}],"predecessor-version":[{"id":172737,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/172668\/revisions\/172737"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=172668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=172668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=172668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}