{"id":181666,"date":"2026-05-22T18:25:08","date_gmt":"2026-05-22T16:25:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti"},"modified":"2026-05-22T18:25:08","modified_gmt":"2026-05-22T16:25:08","slug":"iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","title":{"rendered":"Zero-copy este eliminat din AF_ALG \u00een Linux din motive de securitate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen subsistemul de criptografie Linux se preg\u0103te\u0219te eliminarea suportului zero-copy<\/strong> din interfa\u021b\u0103 AF_ALG<\/strong> pentru tipuri de algoritmi SKCIPHER<\/strong> \u0219i AEAD<\/strong>. Modificarea se afl\u0103 deja \u00een arbori cryptodev \u0219i se a\u0219teapt\u0103 s\u0103 fie trimis\u0103 \u00een fereastra de fuziune Linux 7.2<\/strong>, care ar trebui s\u0103 se deschid\u0103 \u00een iunie. Motivul este cre\u0219terea preocup\u0103rilor legate de securitatea mecanismelor zero-copy \u00een kernel, \u00een special dup\u0103 recentele vulnerabilit\u0103\u021bi din codul criptografic Linux.<\/p>\n

<\/p>\n

AF_ALG<\/strong> \u2014 acesta este interfa\u021ba utilizatorului<\/a> la API-ul criptografic al kernel-ului Linux. Prin intermediul acestuia, programele pot accesa implement\u0103rile de criptare, hash-uri \u0219i algoritmi AEAD din kernel ca pe socket-uri. Documenta\u021bia Linux descrie separat pentru AF_ALG modul zero-copy prin splice() \u0219i vmsplice(), \u00een care kernel-ul \u00eencearc\u0103 s\u0103 evite copierea inutil\u0103 a datelor \u00een memoria kernel-ului.<\/p>\n

<\/noindex><\/noindex><\/p>\n

<\/p>\n

Problema este c\u0103, \u00een cazul AF_ALG, acest c\u00e2\u0219tig de performan\u021b\u0103 s-a dovedit a fi mai pu\u021bin semnificativ, iar riscurile sunt prea mari. Autorul modific\u0103rii, dezvoltatorul subsistemului criptografic Linux Eric Biggers de la Google, am indicat<\/a>, afirm\u0103 c\u0103 zero-copy permite utiliz\u0103rii spa\u021biului utilizatorului s\u0103 efectueze opera\u021bii criptografice direct pe paginile cache-ului de pagin\u0103 al fi\u0219ierelor, de exemplu binarului su, \u0219i creeaz\u0103 condi\u021bii pentru vulnerabilit\u0103\u021bile TOCTOU, c\u00e2nd memoria poate fi modificat\u0103 simultan cu opera\u021bia deasupra ei.<\/p>\n

<\/noindex><\/p>\n

Cu alte cuvinte, mecanismul, util \u00een intr\u0103rile ie\u0219ire de re\u021bea sau fi\u0219ier, \u00een AF_ALG pare a fi o optimizare prea periculoas\u0103. AF_ALG, conform dezvoltatorului, este p\u0103strat \u00een principal pentru compatibilitate \u00eenapoi cu un set restr\u00e2ns de programe, cum ar fi iwd, care nu au fost \u00eenc\u0103 migrate la criptografia \u00een spa\u021biul utilizatorului. AF_ALG a fost g\u00e2ndit ini\u021bial \u0219i pentru accesul la acceleratoare criptografice hardware, dar s-a dovedit a fi un interface nu foarte eficient pentru aceast\u0103 sarcin\u0103.<\/p>\n

Este important de men\u021bionat c\u0103 nu se discut\u0103 despre eliminarea complet\u0103 a splice() sau sendfile() pentru AF_ALG. Modificarea este descris\u0103 ca o \"defec\u021biune moale\" a compatibilit\u0103\u021bii: transmiterea datelor \u00een cererile AF_ALG prin splice() \u0219i sendfile() va continua s\u0103 func\u021bioneze, dar kernel-ul va face acum o copie stabil\u0103 intern\u0103 a datelor \u00eenainte de opera\u021bia criptografic\u0103. Performan\u021ba \u00een unele cazuri poate sc\u0103dea, dar API-ul utilizatorului nu este formal afectat.<\/p>\n

Se subliniaz\u0103 separat c\u0103, deocamdat\u0103, zero-copy este eliminat din skcipher<\/strong> \u0219i aead<\/strong>. Suportul pentru tipul hash<\/strong> va fi discutat separat.<\/p>\n

<\/p>\n

Contextul modific\u0103rii este nepl\u0103cut. La sf\u00e2r\u0219itul lunii aprilie a fost descoperit\u0103 o vulnerabilitate Copy Fail<\/a><\/strong> (CVE-2026-31431<\/strong>) \u00een algif_aead, adic\u0103 tocmai \u00een interfa\u021ba de criptare pentru utilizatori AF_ALG. Cercet\u0103torii au ar\u0103tat c\u0103 leg\u0103tura AF_ALG, splice() \u0219i particularit\u0103\u021bile proces\u0103rii AEAD permiteau unui utilizator f\u0103r\u0103 privilegii s\u0103 corup\u0103 cache-ul paginilor, inclusiv paginile asociate binarelor setuid, \u0219i s\u0103 ob\u021bin\u0103 cre\u0219terea privilegiilor p\u00e2n\u0103 la root.<\/p>\n

<\/noindex>
\n<\/p>\n

Apari\u021bia Copy Fail<\/a> a fost asociat\u0103 cu optimizarea din 2017, care a transformat opera\u021biile AEAD \u00een procesare \u201e\u00een loc\u201d. La transmiterea fi\u0219ierului prin splice() \u00een AF_ALG, nucleul lucra nu cu o copie, ci cu referin\u021be la paginile din cache. Ca rezultat, o parte din datele considerate doar ca intr\u0103ri putea ap\u0103rea \u00een scatterlist-ul scris.<\/p>\n

<\/noindex><\/p>\n

Eliminarea zero-copy din AF_ALG nu este o corectare punctual\u0103 a unei singure vulnerabilit\u0103\u021bi. Mai degrab\u0103, este o \u00eencercare de a elimina o \u00eentreag\u0103 clas\u0103 de scenarii riscante dintr-un UAPI slab utilizat, unde c\u00e2\u0219tigul din optimizare nu justific\u0103 complexitatea \u0219i consecin\u021bele poten\u021biale. Pentru utilizatorii obi\u0219nui\u021bi, modificarea va r\u0103m\u00e2ne cel mai probabil invizibil\u0103; pentru programele rare care folosesc activ AF_ALG prin splice() sau sendfile(), s-ar putea s\u0103 apar\u0103 o sc\u0103dere a performan\u021bei din cauza copierii suplimentare.<\/p>\n

Sursa: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0443\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 cryptodev \u0438 \u043e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f \u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0432 \u043e\u043a\u043d\u043e \u0441\u043b\u0438\u044f\u043d\u0438\u044f Linux 7.2, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c\u0441\u044f \u0432 \u0438\u044e\u043d\u0435. \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0441\u0442\u0430\u043b\u0438 \u0440\u0430\u0441\u0442\u0443\u0449\u0438\u0435 \u043e\u043f\u0430\u0441\u0435\u043d\u0438\u044f \u0432\u043e\u043a\u0440\u0443\u0433 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 zero-copy-\u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0432 \u044f\u0434\u0440\u0435, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u0434\u0435 Linux. AF_ALG […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181666","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Zero-copy din AF_ALG este eliminat \u00een Linux din motive de securitate | ProHoster","description":"\u00cen subsistemul de criptografie Linux se preg\u0103te\u0219te eliminarea suportului zero-copy din interfa\u021ba AF_ALG pentru tipurile de algoritmi SKCIPHER \u0219i AEAD.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437 AF_ALG \u0432 Linux \u0443\u0431\u0438\u0440\u0430\u044e\u0442 zero-copy \u0438\u0437 \u0441\u043e\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-22T16:25:08+00:00","article:modified_time":"2026-05-22T16:25:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/181666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=181666"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/181666\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=181666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=181666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=181666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}