{"id":183410,"date":"2026-09-20T10:54:15","date_gmt":"2026-09-20T08:54:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/opasnye-uyazvimosti-v-yadre-linux-kvm-exim-unbound-ghostscript-i-suricata"},"modified":"2026-09-20T10:54:15","modified_gmt":"2026-09-20T08:54:15","slug":"serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","title":{"rendered":"Vulnerabilit\u0103\u021bi periculoase \u00een nucleul Linux, KVM, Exim, Unbound, Ghostscript \u0219i Suricata","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>C\u00e2teva vulnerabilit\u0103\u021bi recente periculoase care permit ob\u021binerea de acces root \u00een sistem sau executarea de cod de la distan\u021b\u0103.  <\/p>\n<ul>\n<li class=\"l\"> Informa\u021biile despre patru vulnerabilit\u0103\u021bi \u00een kernelul Linux, care permit unui utilizator local neprivilegiat s\u0103 execute cod cu drepturi de root, au fost dezv\u0103luite. Problemele au fost remediate \u00een actualiz\u0103rile kernelului Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 \u0219i 7.2.4. Exploat\u0103rile pentru toate vulnerabilit\u0103\u021bile sunt disponibile, demonstr\u00e2ndu-se func\u021bionarea acestora \u00een Fedora 43\/44 \u0219i Ubuntu 24.04. Pentru exploatarea primelor trei vulnerabilit\u0103\u021bi, este necesar\u0103 capacitatea de a crea spa\u021bii de nume pentru identificatori de utilizatori (user namespace) sau existen\u021ba permisiunilor CAP_NET_ADMIN, precum \u0219i activarea suportului pentru subsistemele \u00een care se afl\u0103 vulnerabilit\u0103\u021bile (AH6\/XFRM, TUN, PPPoE \u0219i SCTP).\n<ul>\n<li class=\"l\"> DirtyAH6 (CVE-2026-80844, exploit) \u2014 o dep\u0103\u0219ire a buffer-ului \u00een manipularea IPsec AH (Authentication Header), care apare din cauza lipsei verific\u0103rii valorilor specificate \u00een antet. \u00cen plus fa\u021b\u0103 de realizarea local\u0103 a atacului, vulnerabilitatea ar putea fi exploatat\u0103 teoretic de la distan\u021b\u0103 \u00een condi\u021bii specifice.\n<li class=\"l\"> TUNderflow (CVE-2026-81000, exploit) \u2014 scrierea dincolo de buffer-ul alocat \u00een procesarea unui pachet TUN format incorect.\n<li class=\"l\"> PPPoEject (CVE-2026-68121, exploit) \u2014 accesarea unei memorii deja eliberate \u00een driver-ul PPPoE.\n<li class=\"l\"> DiagSpill (CVE-2026-74469, exploit) \u2014 o dep\u0103\u0219ire a buffer-ului \u00een instrumentele de diagnosticare a protocolului SCTP. \u00cen plus fa\u021b\u0103 de atacul local, vulnerabilitatea ar putea fi exploatat\u0103 teoretic de la distan\u021b\u0103 \u00een condi\u021bii specifice.     <\/ul>\n<li class=\"l\"> Vulnerabilitatea (CVE-2026-89775) \u00een hipervizor <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/vps\/abuzoustojchivye-vps\/\" title=\"KVM\" data-wpil-keyword-link=\"linked\">KVM<\/a>, permi\u021b\u00e2nd accesul la mediu host din sistemul gazd\u0103. Dac\u0103 utilizatorii neprivilegia\u021bi au acces la dispozitivul \/dev\/kvm (implicit \u00een RHEL), vulnerabilitatea poate fi folosit\u0103 pentru a-\u0219i cre\u0219te privilegiile \u00een sistem. Problema apare doar pe sistemele cu arhitectur\u0103 ARM64 cu suport pentru virtualizare \u00eencorporat\u0103 activat. Vulnerabilitatea este cauzat\u0103 de faptul c\u0103 procedura de calcul a dimensiunii returna \u201e0\u201d, suger\u00e2nd c\u0103 dimensiunea este necunoscut\u0103, iar func\u021bia de eliberare a paginilor de memorie trata \u201e0\u201d ca o valoare efectiv\u0103 \u0219i nu cur\u0103\u021ba paginile de memorie.\n<li class=\"l\"> \u00cen versiunea de po\u0219t\u0103 <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/dts-los-angeles\/\" title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> Exim 4.100.1 au fost remediate 4 vulnerabilit\u0103\u021bi: citirea datelor din afara bufferului \u0219i utilizarea datelor neini\u021bializate \u00een implementarea protocolului Proxy; accesarea memoriei dup\u0103 eliberare \u00een TLS-on-connect folosind GnuTLS; introducerea unui mesaj \u00een fluxul altuia (SMTP smuggling).\n<li class=\"l\"> \u00cen pachetul Ghostscript 10.08.0 a fost eliminat\u0103 vulnerabilitatea (CVE-2026-39919) cauzat\u0103 de un overflow de buffer \u00een codul de analize pentru formatul JPEG 2000, atunci c\u00e2nd sunt specificate valori incorecte de subsampling. Problema poate duce la executarea de cod \u00een Ghostscript atunci c\u00e2nd se proceseaz\u0103 fi\u0219iere PDF special concepute, cu imagini integrate \u00een format JPEG 2000. Pericolul vulnerabilit\u0103\u021bii este amplificat de faptul c\u0103 Ghostscript este apelat \u00een procesul de creare a miniaturilor pe desktop, \u00een cadrul index\u0103rii de fond a datelor \u0219i \u00een timpul conversiei imaginilor. Pentru a efectua un atac cu succes, \u00een multe cazuri este suficient s\u0103 se \u00eencarce un fi\u0219ier cu un exploit sau s\u0103 se vizualizeze un catalog care \u00eel con\u021bine \u00een Nautilus. De asemenea, vulnerabilit\u0103\u021bile din Ghostscript pot fi exploatate prin intermediul handlerelor de imagini bazate pe pachetele ImageMagick \u0219i GraphicsMagick, prin transmiterea unui fi\u0219ier JPEG sau PNG \u00een care, \u00een loc de imagine, se afl\u0103 cod PostScript (acest fi\u0219ier va fi procesat \u00een Ghostscript, deoarece tipul MIME este recunoscut pe baza con\u021binutului, nu pe extensie). Problema a fost remediat\u0103 \u00een Ghostscript 10.08.0.\n<li class=\"l\"> \u00cen serverul DNS Unbound 1.26.1 au fost eliminate 9 vulnerabilit\u0103\u021bi, printre care problema CVE-2026-81642, care duce la un overflow de buffer \u00een timpul proces\u0103rii anumitor DNSKEY. Vulnerabilitatea poate fi utilizat\u0103 pentru execu\u021bia de cod la distan\u021b\u0103 pe <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/dts-dronten\/\" title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a>. Au fost de asemenea remediate: overflow de buffer \u00een codul de lucru cu DNSSEC, coruperea datelor \u00een memorie \u00een handlerul CNAME, accesarea memoriei deja eliberate \u00een codul DoQ \u0219i DoH.\n<li class=\"l\"> \u00cen sistemul de detectare \u0219i prevenire a atacurilor Suricata 8.0.7 au fost rezolvate 67 de vulnerabilit\u0103\u021bi, dintre care dou\u0103 sunt marcate ca critice. Detaliile despre probleme nu sunt deocamdat\u0103 dezv\u0103luite, dar av\u00e2nd \u00een vedere nivelul de pericol, vulnerabilit\u0103\u021bile permit execu\u021bia de cod la distan\u021b\u0103 \u00een timpul proces\u0103rii traficului special conceput.  <\/ul>\n<p>Sursa: <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66310\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430. \u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0434\u0430\u044e\u0449\u0438\u0445 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u044f\u0434\u0440\u0430 Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 \u0438 7.2.4. \u0414\u043b\u044f \u0432\u0441\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b, \u0440\u0430\u0431\u043e\u0442\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183410","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, KVM, Exim, Unbound, Ghostscript \u0438 Suricata | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-20T08:54:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-20T08:54:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi periculoase \u00een nucleul Linux, KVM, Exim, Unbound, Ghostscript \u0219i Suricata | ProHoster","description":"C\u00e2teva vulnerabilit\u0103\u021bi recente periculoase care permit ob\u021binerea de acces root \u00een sistem sau executarea de cod de la distan\u021b\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, KVM, Exim, Unbound, Ghostscript \u0438 Suricata | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-09-20T08:54:15+00:00","article:modified_time":"2026-09-20T08:54:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"183410","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-09-22 16:20:59","updated":"2026-09-22 16:20:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=183410"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183410\/revisions"}],"predecessor-version":[{"id":183425,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183410\/revisions\/183425"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=183410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=183410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=183410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}