{"id":170863,"date":"2026-05-18T12:24:54","date_gmt":"2026-05-18T10:24:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root"},"modified":"2026-05-18T12:24:54","modified_gmt":"2026-05-18T10:24:54","slug":"v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","title":{"rendered":"V Linux bola odhalen\u00e1 nov\u00e1 zranite\u013enos\u0165 LPE Fragnesia, ktor\u00e1 umo\u017e\u0148uje lok\u00e1lnemu u\u017e\u00edvate\u013eovi z\u00edska\u0165 root pr\u00e1va","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V jadre Linuxu bola odhalen\u00e1 \u010fal\u0161ia zranite\u013enos\u0165 lok\u00e1lneho zv\u00fd\u0161enia opr\u00e1vnen\u00ed s n\u00e1zvom Fragnesia<\/strong> a identifik\u00e1torom CVE-2026-46300<\/strong>. Probl\u00e9m patr\u00ed do rovnakej triedy \u00fatokov na page cache, ako ned\u00e1vno diskutovan\u00e9 Copy Fail a Dirty Frag, ale nejde o op\u00e4tovn\u00e9 zverejnenie starej chyby: ide o samostatn\u00fa chybu v k\u00f3de XFRM ESP-in-TCP<\/strong>.<\/p>\n

Zranite\u013enos\u0165 objavil v\u00fdskumn\u00edk William Bowling<\/strong> z t\u00edmu V12 Security<\/strong>. Pod\u013ea zverejnen\u00e9ho popisu, Fragnesia umo\u017e\u0148uje neopr\u00e1vnen\u00e9mu lok\u00e1lnemu u\u017e\u00edvate\u013eovi meni\u0165 obsah s\u00faborov, ktor\u00e9 s\u00fa pr\u00edstupn\u00e9 iba na \u010d\u00edtanie, v pam\u00e4ti page cache a t\u00fdm p\u00e1dom vykon\u00e1va\u0165 k\u00f3d s pr\u00e1vami root. Na rozdiel od mnoh\u00fdch star\u00fdch LPE exploitov, \u00fatok nevy\u017eaduje pretekanie a je op\u00edsan\u00fd v\u00fdskumn\u00edkmi ako deterministick\u00fd.<\/p>\n

Technicky je probl\u00e9m spojen\u00fd s t\u00fdm, \u017ee pri zl\u00fa\u010den\u00ed sie\u0165ov\u00fdch bufferov jadro mohlo strati\u0165 znak toho, \u017ee fragment \u00fadajov je 'sdru\u017een\u00fd' a spojen\u00fd s externou str\u00e1nkou pam\u00e4te, vr\u00e1tane page cache. V navrhnutom oprave je to op\u00edsan\u00e9 ako chyba v skb_try_coalesce(): pri prenose paged fragments z jedn\u00e9ho sk_buff do druh\u00e9ho nebol zachovan\u00fd flag SKBFL_SHARED_FRAG. V d\u00f4sledku toho mohol neskor\u0161\u00ed k\u00f3d ESP chybne pova\u017eova\u0165 buffer za bezpe\u010dn\u00fd na zmenu.<\/p>\n

Praktick\u00fd efekt spo\u010d\u00edva v tom, \u017ee d\u00e1ta, ktor\u00e9 boli predt\u00fdm umiestnen\u00e9 do TCP fronty zo s\u00faboru, mohli by\u0165 po prepnut\u00ed socketu do m\u00f3du espintcp spracov\u00e1van\u00e9 jadrom ako ESP \u0161ifrovan\u00fd text. Pri de\u0161ifrovan\u00ed AES-GCM sa bajty menili priamo na str\u00e1nke page cache, ktor\u00e1 je spojen\u00e1 so s\u00faborom. To nemn\u00ed s\u00fabor na disku, ale men\u00ed jeho zobrazenie v pam\u00e4ti, k\u00fdm sa str\u00e1nka nevytesn\u00ed z cache.<\/p>\n

Vo zverejnenej demon\u0161tr\u00e1cii \u00fatoku bol ako cie\u013e pou\u017eit\u00fd \/usr\/bin\/su: exploit modifikoval prv\u00e9 bajty bin\u00e1rneho s\u00faboru v page cache a potom spustil zmenen\u00fa v pam\u00e4ti k\u00f3piu, z\u00edskavaj\u00fac shell s pr\u00e1vami root. P\u00f4vodn\u00fd s\u00fabor na disku pritom ost\u00e1val nezmenen\u00fd, \u010do rob\u00ed probl\u00e9m obzvl\u00e1\u0161\u0165 nepr\u00edjemn\u00fdm na diagnostiku: stopy exploat\u00e1cie m\u00f4\u017eu zmizn\u00fa\u0165 po vy\u010disten\u00ed page cache alebo re\u0161tartovan\u00ed.<\/p>\n

Fragnesia sa objavila za menej ne\u017e t\u00fd\u017ede\u0148 po Dirty Frag. V V12 zd\u00f4raz\u0148uj\u00fa, \u017ee ide o samostatn\u00fa zranite\u013enos\u0165 v tej istej \u00fato\u010dnej ploche \u2014 ESP\/XFRM, a nie premenovanie u\u017e opraven\u00e9ho zranite\u013en\u00e9ho miesta. Phoronix tie\u017e poznamen\u00e1va, \u017ee v \u010dase publikovania bol k dispoz\u00edcii proof-of-concept a oprava predstavovala mal\u00fd patch do net\/core\/skbuff.c, ktor\u00fd sa e\u0161te nedostal do hlavn\u00fdch vetiev jadra.<\/p>\n

<\/p>\n

Canonical pridelil CVE-2026-46300<\/a> vysok\u00fa prioritu pre Ubuntu, pri\u010dom ako d\u00f4vod uviedol \u201etrivial local privilege escalation\u201c. Na str\u00e1nke Ubuntu Security pre postihnut\u00e9 jadr\u00e1 bol k 13. m\u00e1ju zaznamenan\u00fd status \u201eNeeds evaluation\u201c a v pozn\u00e1mke sa osobitne uv\u00e1dza, \u017ee probl\u00e9m sa tie\u017e vyskytuje v ESP module jadra a m\u00f4\u017ee by\u0165 do\u010dasne zmiernen\u00fd rovnak\u00fdm sp\u00f4sobom ako Dirty Frag.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Debian Security Tracker<\/a> v \u010dase kontroly ozna\u010doval za zranite\u013en\u00e9 jadr\u00e1 v vetv\u00e1ch bullseye, bookworm, trixie, forky a sid; pre bal\u00edk linux v unstable e\u0161te nebola uveden\u00e1 opraven\u00e1 verzia.<\/p>\n

<\/noindex> <\/p>\n

Do\u010dasn\u00e9 ochrann\u00e9 opatrenie ost\u00e1va rovnak\u00e9 ako pre Dirty Frag: deaktivova\u0165 na\u010d\u00edtanie modulov<\/a> esp4, esp6 a rxrpc, ak nie s\u00fa syst\u00e9mu potrebn\u00e9. To m\u00f4\u017ee naru\u0161i\u0165 fungovanie IPsec tunelov na uzloch, kde sa pou\u017e\u00edvaj\u00fa kernel ESP, strongSwan, Libreswan alebo podobn\u00e9 konfigur\u00e1cie, tak\u017ee na VPN br\u00e1nach by sa toto opatrenie malo uplatni\u0165 len po pos\u00faden\u00ed n\u00e1sledkov.<\/p>\n

<\/noindex> <\/p>\n

Pr\u00edklad do\u010dasn\u00e9ho zmiernenia pre administr\u00e1torov:<\/p>\n

sudo sh -c \"printf 'install esp4 \/bin\/falseninstall esp6 \/bin\/falseninstall rxrpc \/bin\/falsen' > \/etc\/modprobe.d\/dirtyfrag.conf\" sudo rmmod esp4 esp6 rxrpc 2>\/dev\/null || true <\/p>\n

Ak existuje podozrenie, \u017ee syst\u00e9m u\u017e mohol by\u0165 napadnut\u00fd, samotn\u00e1 blok\u00e1cia modulov nesta\u010d\u00ed: ke\u010f\u017ee verejn\u00e1 demon\u0161tr\u00e1cia men\u00ed spustite\u013en\u00fd s\u00fabor konkr\u00e9tne v str\u00e1nkovacej caches, administr\u00e1tori odpor\u00fa\u010daj\u00fa vy\u010disti\u0165 cache str\u00e1nok alebo re\u0161tartova\u0165 syst\u00e9m po prijat\u00ed ochrann\u00fdch opatren\u00ed. CloudLinux priamo uv\u00e1dza, \u017ee po exploit\u00e1cii \/usr\/bin\/su m\u00f4\u017ee zosta\u0165 zmenen\u00fd v pam\u00e4ti a\u017e do vytesnenia pr\u00edslu\u0161n\u00fdch str\u00e1nok.<\/p>\n

Na odstr\u00e1nenie do\u010dasn\u00e9ho pravidla po in\u0161tal\u00e1cii opraven\u00e9ho jadra m\u00f4\u017eete odstr\u00e1ni\u0165 vytvoren\u00fd s\u00fabor:<\/p>\n

sudo rm \/etc\/modprobe.d\/dirtyfrag.conf <\/p>\n

Hlavn\u00e9 odpor\u00fa\u010danie zost\u00e1va \u0161tandardn\u00e9: nain\u0161talova\u0165 opraven\u00e9 jadro od svojho distribu\u010dn\u00e9ho syst\u00e9mu a re\u0161tartova\u0165 syst\u00e9m. Pred aktualiz\u00e1ciou nes\u00fa najvy\u0161\u0161ie riziko viacu\u017e\u00edvate\u013esk\u00e9 servery, CI be\u017eci, zdie\u013ean\u00fd hosting, kontajnerov\u00e9 build farmy a ak\u00e9ko\u013evek stroje, kde m\u00f4\u017eu nezabezpe\u010den\u00ed alebo \u010diasto\u010dne d\u00f4veryhodn\u00ed pou\u017e\u00edvatelia sp\u00fa\u0161\u0165a\u0165 lok\u00e1lny k\u00f3d.<\/p>\n

Zdroj: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Fragnesia \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2026-46300. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 page cache, \u0447\u0442\u043e \u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u0432\u0448\u0438\u0435\u0441\u044f Copy Fail \u0438 Dirty Frag, \u043d\u043e \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0441\u0442\u0430\u0440\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438: \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043e\u0431 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u043c \u0434\u0435\u0444\u0435\u043a\u0442\u0435 \u0432 \u043a\u043e\u0434\u0435 XFRM ESP-in-TCP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c William Bowling […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170863","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V Linuxe bola odhalen\u00e1 nov\u00e1 zranite\u013enos\u0165 LPE Fragnesia, ktor\u00e1 umo\u017e\u0148uje lok\u00e1lnemu pou\u017e\u00edvate\u013eovi z\u00edska\u0165 root | ProHoster","description":"V jadre Linuxu bola odhalen\u00e1 \u010fal\u0161ia zranite\u013enos\u0165 lok\u00e1lneho zv\u00fd\u0161enia opr\u00e1vnen\u00ed s n\u00e1zvom Fragnesia a identifik\u00e1torom CVE-2026-46300.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Fragnesia, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Fragnesia \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2026-46300.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T10:24:54+00:00","article:modified_time":"2026-05-18T10:24:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/170863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=170863"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/170863\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=170863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=170863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=170863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}