{"id":181735,"date":"2026-05-25T20:48:34","date_gmt":"2026-05-25T18:48:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root"},"modified":"2026-05-25T20:48:34","modified_gmt":"2026-05-25T18:48:34","slug":"gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","title":{"rendered":"GRO Frag: nou\u0103 vulnerabilitate LPE \u00een stiva de re\u021bea Linux permite ob\u021binerea accesului root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>      <noindex><\/p>\n<p>A ap\u0103rut un exploit pentru <strong>GRO Frag<\/strong> \u2014 o vulnerabilitate local\u0103 de escaladare a privilegiilor \u00een kernelul Linux, legat\u0103 de procesarea GRO \u0219i zero-copy skb \u00een stiva de re\u021bea. <strong>Data exact\u0103 a descoperirii ini\u021biale \u00een materialele publice nu este specificat\u0103<\/strong>. Pe baza urmelor deschise, se pot observa dou\u0103 date: corec\u021bia a fost discutat\u0103 \u00een lista de coresponden\u021b\u0103 netdev <strong>20 mai 2026<\/strong>, unde aceast\u0103 vulnerabilitate a fost deja descris\u0103 ca fiind capabil\u0103 de rescrierea page cache-ului, iar un PoC public a fost postat pe <a rel=\"nofollow\" href=\"https:\/\/www.spinics.net\/lists\/netdev\/msg1189117.html\">GitHub Gist<\/a> <strong>22 mai 2026<\/strong>.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p>Ca m\u0103sur\u0103 temporar\u0103, p\u00e2n\u0103 la instalarea kernelului corectat, se poate limita vectorul de atac prin sysctl: kernel.io_uring_disabled=1. Acest mod interzice crearea de noi instan\u021be io_uring de c\u0103tre procesele neprivilegiate, dac\u0103 acestea nu sunt incluse \u00een grupul permis io_uring_group; cu o valoare de grup -1, accesul este men\u021binut doar de c\u0103tre procese cu CAP_SYS_ADMIN. Aceasta este o mitigare, nu o corectare complet\u0103 a vulnerabilit\u0103\u021bii.<\/p>\n<p>Problema se afl\u0103 \u00een func\u021bia skb_gro_receive(): \u00een timpul combin\u0103rii pachetelor GRO, kernelul putea transfera fragmente din zero-copy skb \u00een alt skb f\u0103r\u0103 o verificare corect\u0103 a st\u0103rii zero-copy \u0219i a semnului SKBFL_MANAGED_FRAG_REFS. Drept urmare, paginile de memorie, pentru care skb-ul ini\u021bial nu avea referin\u021be separate, puteau fi eliberate incorect, ceea ce ducea la use-after-free. \u00cen patch este specificat clar c\u0103 o astfel de situa\u021bie poate duce la UAF, precum \u0219i c\u0103 varianta g\u0103sit\u0103 era capabil\u0103 de rescrierea page cache-ului.<\/p>\n<p><noindex><\/p>\n<p>PoC-ul publicat descrie vulnerabilitatea ca <strong>LPE prin GRO managed-frag UAF<\/strong> folosind io_uring SEND_ZC \u0219i interfa\u021ba de re\u021bea virtual\u0103 veth. \u00cen comentariul din cod se men\u021bioneaz\u0103 c\u0103 sunt afectate kernelurile <strong>Linux 6.0+<\/strong>, exploatarea este posibil\u0103 de c\u0103tre un utilizator neprivilegiat, dar necesit\u0103 un io_uring disponibil; ca corectare este men\u021bionat\u0103 <a rel=\"nofollow\" href=\"https:\/\/gist.github.com\/lcfr-eth\/2566a5cef312c94a5ff8d62fa417955f\">commit<\/a> 4db79a322db8 cu modificarea \u201enet: gro: don't merge zcopy skbs\u201d.<\/p>\n<p><\/noindex><br \/>\n<noindex><\/p>\n<p>\u00cen ceea ce prive\u0219te consecin\u021bele, GRO Frag se \u00eencadreaz\u0103 \u00een aceea\u0219i categorie periculoas\u0103 de erori ca Copy Fail \u0219i Dirty Frag: un atacator cu acces neprivilegiat local poate modifica datele din page cache, adic\u0103 \u00een memorie, f\u0103r\u0103 a necesita modificarea fi\u0219ierului pe disc. Astfel de erori sunt deosebit de nepl\u0103cute deoarece afecteaz\u0103 limita dintre fi\u0219ierul \u201edoar pentru citire\u201d \u0219i con\u021binutul efectiv vizibil de kernel \u0219i de procese \u00een apelurile ulterioare. Elastic <a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/security-labs\/copy-fail-dirtyfrag-linux-page-bugs-in-the-wild\">a descris anterior<\/a> aceast\u0103 categorie ca fiind o modalitate practic\u0103 de a ob\u021bine root prin corup\u021bia page-cache.<\/p>\n<p><\/noindex><\/p>\n<p>La momentul public\u0103rii, un identificator CVE separat pentru GRO Frag, conform informa\u021biilor disponibile, \u00eenc\u0103 nu fusese desemnat. Ca m\u0103suri temporare, administratorii ar trebui s\u0103 se concentreze pe actualizarea nucleului la o versiune cu corectur\u0103, precum \u0219i pe m\u0103suri generale de reducere a riscurilor pentru astfel de LPE: limitarea spa\u021biilor de nume utilizator neprivilegia\u021bi acolo unde este posibil, controlul utiliz\u0103rii io_uring \u0219i monitorizarea lan\u021burilor suspecte legate de escaladarea local\u0103 a privilegiilor. Pentru atacurile similare Copy Fail\/DirtyFrag, Elastic recomand\u0103, de asemenea, combinarea patch-urilor cu detectarea primitivelor de exploatare la nivel redus.<\/p>\n<p>Primitivii de exploatare la nivel redus nu reprezint\u0103 un \u201ehacking gata f\u0103cut\u201d, ci tehnicile tehnice de baz\u0103 din care se construie\u0219te un exploit.<\/p>\n<p>\u00cen contextul GRO Frag, aceasta poate \u00eensemna nu detectarea deja finalizat\u0103 a \u201eutilizatorului care a devenit root\u201d, ci \u00eencercarea de a observa ac\u021biuni suspecte separate pe care exploitul le folose\u0219te pe calea c\u0103tre cre\u0219terea privilegiilor.<\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18300059\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435. \u0422\u043e\u0447\u043d\u0430\u044f \u0434\u0430\u0442\u0430 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430\u0445 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u0430. \u041f\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0441\u043b\u0435\u0434\u0430\u043c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0432\u0435 \u0434\u0430\u0442\u044b: \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u043b\u043e\u0441\u044c \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438 netdev 20 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430, \u0433\u0434\u0435 \u0434\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181735","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47GRO Frag: \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435 Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-25T18:48:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-25T18:48:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47GRO Frag: nou\u0103 vulnerabilitate LPE \u00een stiva de re\u021bea Linux permite ob\u021binerea accesului root | ProHoster","description":"Un exploit pentru GRO Frag \u2014 o vulnerabilitate local\u0103 de cre\u0219tere a privilegiilor \u00een nucleul Linux, legat\u0103 de gestionarea GRO \u0219i skb zero-copy \u00een stiva de re\u021bea \u2014 a devenit disponibil public.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GRO Frag: \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435 Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f GRO Frag \u2014 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 GRO \u0438 zero-copy skb \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0442\u0435\u043a\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/gro-frag-novaya-lpe-uyazvimost-v-setevom-steke-linux-pozvolyaet-poluchit-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-25T18:48:34+00:00","article:modified_time":"2026-05-25T18:48:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/181735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=181735"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/181735\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=181735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=181735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=181735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}