{"id":181690,"date":"2026-05-23T18:24:43","date_gmt":"2026-05-23T16:24:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux"},"modified":"2026-05-23T18:24:43","modified_gmt":"2026-05-23T16:24:43","slug":"opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","title":{"rendered":"A fost publicat un PoC pentru DirtyDecrypt \u2014 o nou\u0103 vulnerabilitate LPE \u00een nucleul Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>      <noindex><\/p>\n<p>A fost publicat un proof-of-concept pentru vulnerabilitate <strong>DirtyDecrypt<\/strong>, de asemenea, cunoscut sub numele de <strong>DirtyCBC<\/strong>, care permite unui utilizator local f\u0103r\u0103 privilegii s\u0103 ob\u021bin\u0103 drepturi de root pe anumite sisteme Linux. Problema se afl\u0103 \u00een codul <strong>rxgk<\/strong> al subsistemului <strong>RxRPC<\/strong> \u0219i este legat\u0103 de scrierea \u00een cache-ul de pagini din cauza lipsei unei verific\u0103ri copy-on-write \u00een func\u021bia rxgk_decrypt_skb(). Publica\u021bia BleepingComputer a anun\u021bat despre publicarea PoC pe 18 mai 2026; PoC-ul poate fi g\u0103sit \u00een <a rel=\"nofollow\" href=\"https:\/\/github.com\/v12-security\/pocs\/tree\/main\/dirtydecrypt\">repository-ul echipei V12<\/a>.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p><noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/docs.kernel.org\/networking\/rxrpc.html\">RxRPC este un protocol de re\u021bea al kernel-ului Linux<\/a> pe UDP, oferind un transport de \u00eencredere pentru opera\u021biuni la distan\u021b\u0103. \u00cen documenta\u021bia kernel-ului se specific\u0103 \u00een mod special c\u0103 <strong>AFS<\/strong> \u2014 Andrew File System \u2014 este un exemplu de aplica\u021bie care utilizeaz\u0103 RxRPC, iar protocolul \u00een sine suport\u0103 negocierile de securitate ale conexiunii. Aceast\u0103 zon\u0103 se refer\u0103 la RxGK, utilizat pentru modul protejat RxRPC\/AFS.<\/p>\n<p><\/noindex><\/p>\n<p>Conform descrierii V12, DirtyDecrypt este o alt\u0103 variant\u0103 a vulnerabilit\u0103\u021bilor din clasa <strong>CopyFail \/ Dirty Frag \/ Fragnesia<\/strong>. Toate acestea se \u00eenv\u00e2rt \u00een jurul unei idei similare: gestionarea necorespunz\u0103toare a memoriei kernel-ului, cache-ului de pagini \u0219i bufferelor poate permite unui proces local f\u0103r\u0103 privilegii s\u0103 influen\u021beze datele care ar trebui s\u0103 fie inaccesibile pentru scriere. \u00cen cazul DirtyDecrypt, se refer\u0103 la \"scrierea \u00een cache-ul de pagini rxgk\" din cauza lipsei protec\u021biei COW \u00een rxgk_decrypt_skb().<\/p>\n<p>Echipa V12 sus\u021bine c\u0103 a descoperit \u0219i raportat problema <strong>9 mai 2026<\/strong>, dar dezvoltatorii kernel-ului au r\u0103spuns c\u0103 este un duplicat al unei erori deja remediate. Dup\u0103 aceea, cercet\u0103torii au publicat PoC, motiv\u00e2nd c\u0103 solu\u021bia se afl\u0103 deja \u00een kernel-ul principal.<\/p>\n<p>Situa\u021bia cu CVE nu este chiar simpl\u0103. BleepingComputer scrie c\u0103 nu exist\u0103 un CVE oficial pentru denumirea DirtyDecrypt la momentul public\u0103rii, dar analistul Will Dormann leag\u0103 detaliile publicate de V12 de <strong>CVE-2026-31635<\/strong>, corectat\u0103 la sf\u00e2r\u0219itul lunii aprilie. \u00cen baza NVD, CVE-2026-31635 este descris\u0103 ca o eroare \u00een rxrpc: func\u021bia rxgk_verify_response() nu verifica corect lungimea autentificatorului RESPONSE, motiv pentru care un autentificator prea mare putea ajunge \u00een rxgk_decrypt_skb() \u0219i ducea codul la BUG_ON(len).<\/p>\n<p><noindex><\/p>\n<p>Astfel, publica\u021biile publice leag\u0103 DirtyDecrypt de <strong><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-31635\">CVE-2026-31635<\/a><\/strong>, dar descrierea formal\u0103 a CVE \u00een NVD pare a fi mai restr\u00e2ns\u0103 \u0219i vorbe\u0219te \u00eenainte de toate despre o eroare de verificare a lungimii \u00een rxrpc, nu despre alias-ul DirtyDecrypt\/DirtyCBC ca o \u00eenregistrare separat\u0103. Prin urmare, este mai corect s\u0103 scriem: <em>DirtyDecrypt, probabil, corespunde sau este str\u00e2ns legat de CVE-2026-31635<\/em>, \u0219i nu s\u0103 afirm\u0103m c\u0103 este un nume oficial CVE.<\/p>\n<p><\/noindex><\/p>\n<p>Pentru func\u021bionare este necesar un nucleu cu op\u021biunea activat\u0103 <strong>CONFIG_RXGK<\/strong>, care activeaz\u0103 suportul RxGK pentru clientul AFS \u0219i pentru transportul de re\u021bea. Aceasta restr\u00e2nge considerabil sistemele afectate: \u00een primul r\u00e2nd, este vorba despre distribu\u021bii care urmeaz\u0103 rapid nucleul upstream, inclusiv <strong>Fedora<\/strong>, <strong>Arch Linux<\/strong> \u0219i <strong>openSUSE Tumbleweed<\/strong>. Totu\u0219i, BleepingComputer subliniaz\u0103 c\u0103 V12 PoC publicat a fost testat doar pe Fedora \u0219i nucleul mainline.<\/p>\n<p><noindex><\/p>\n<p>DirtyDecrypt a ap\u0103rut pe fundalul unei serii \u00eentregi de vulnerabilit\u0103\u021bi LPE Linux de clas\u0103 similar\u0103. Au fost dezv\u0103luite anterior <strong>Copy Fail<\/strong> \u00een algif_aead, <strong>Dirty Frag<\/strong> \u00een componentele de re\u021bea, iar apoi <strong>Fragnesia<\/strong> \u00een XFRM ESP-in-TCP. Microsoft <a rel=\"nofollow\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/05\/08\/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk\/\">a descris<\/a> Dirty Frag ca o elevare local\u0103 a privilegiilor prin componentele esp4, esp6 \u0219i rxrpc, permi\u021b\u00e2nd atacatorului, dup\u0103 ob\u021binerea accesului local, s\u0103 se ridice la nivel de root \u0219i s\u0103 se stabileasc\u0103 \u00een sistem.<\/p>\n<p><\/noindex><\/p>\n<p>Pericolul practic al acestor erori const\u0103 \u00een faptul c\u0103 sunt deseori utilizate deja dup\u0103 compromiterea ini\u021bial\u0103: de exemplu, dup\u0103 compromiterea unui cont SSH, un shell web, un container vulnerabil sau un utilizator de serviciu cu privilegii reduse. Ob\u021bin\u00e2nd acces la root, atacatorul poate dezactiva m\u0103surile de protec\u021bie, citi secrete, modifica jurnalele, desf\u0103\u0219ura m\u0103suri de persistente \u0219i avansa \u00een infrastructur\u0103.<\/p>\n<p>Utilizatorilor distribu\u021biilor rolling-release poten\u021bial afectate li se recomand\u0103 s\u0103 instaleze cele mai recente actualiz\u0103ri ale nucleului. Pentru sistemele \u00een care actualizarea imediat\u0103 este imposibil\u0103, se men\u021bioneaz\u0103 m\u0103suri temporare precum dezactivarea modulelor rxrpc neutilizate \u0219i a componentelor asociate, cu toate acestea, astfel de solu\u021bii de ocolire pot rupe AFS \u0219i unele scenarii IPsec\/VPN, de aceea acestea trebuie aplicate doar dup\u0103 verificarea impactului asupra sistemului specific.<\/p>\n<p>Pentru majoritatea instala\u021biilor de birou \u0219i server, riscul este probabil mai mic dec\u00e2t \u00een cazul Copy Fail: DirtyDecrypt necesit\u0103 o configura\u021bie specific\u0103 a nucleului \u0219i execu\u021bia local\u0103 a codului. Totu\u0219i, pentru Fedora, Arch Linux, openSUSE Tumbleweed \u0219i alte sisteme cu actualiz\u0103ri rapide ale nucleului, problema merit\u0103 aten\u021bie: aceasta nu mai este un raport teoretic, ci o vulnerabilitate cu PoC publicat \u0219i un mod clar de cre\u0219tere a privilegiilor.<\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18296676\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043a\u043e\u0434\u0435 rxgk \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b RxRPC \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0432 page cache \u0438\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 copy-on-write \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 rxgk_decrypt_skb(). \u041e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 PoC 18 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u043e \u0438\u0437\u0434\u0430\u043d\u0438\u0435 BleepingComputer; \u0441\u0430\u043c PoC \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181690","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC \u0434\u043b\u044f DirtyDecrypt \u2014 \u043d\u043e\u0432\u043e\u0439 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-23T16:24:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-23T16:24:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47A fost publicat PoC pentru DirtyDecrypt \u2014 o nou\u0103 vulnerabilitate LPE \u00een nucleul Linux | ProHoster","description":"A fost publicat un proof-of-concept pentru vulnerabilitatea DirtyDecrypt, cunoscut\u0103 \u0219i sub numele de DirtyCBC, care permite unui utilizator local f\u0103r\u0103 privilegii s\u0103 ob\u021bin\u0103 drepturi.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC \u0434\u043b\u044f DirtyDecrypt \u2014 \u043d\u043e\u0432\u043e\u0439 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-23T16:24:43+00:00","article:modified_time":"2026-05-23T16:24:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/181690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=181690"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/181690\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=181690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=181690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=181690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}