{"id":181666,"date":"2026-05-22T18:25:08","date_gmt":"2026-05-22T16:25:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti"},"modified":"2026-05-22T18:25:08","modified_gmt":"2026-05-22T16:25:08","slug":"iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","title":{"rendered":"Z rozhran\u00ed AF_ALG v Linuxe odstra\u0148uj\u00fa zero-copy z bezpe\u010dnostn\u00fdch d\u00f4vodov","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V subsyst\u00e9me kryptografie Linux sa pripravuje odstr\u00e1nenie podpory <strong>zero-copy<\/strong> z rozhrania <strong>AF_ALG<\/strong> pre typy algoritmov <strong>SKCIPHER<\/strong> a <strong>AEAD<\/strong>. Zmena je u\u017e vo vetve cryptodev a o\u010dak\u00e1va sa, \u017ee bude zaslan\u00e1 do okna zl\u00fa\u010denia <strong>Linux 7.2<\/strong>, ktor\u00e9 sa m\u00e1 otvori\u0165 v j\u00fani. D\u00f4vodom s\u00fa rast\u00face obavy okolo bezpe\u010dnosti zero-copy mechanizmov v jadre, najm\u00e4 po ned\u00e1vnych zranite\u013enostiach v kryptografickom k\u00f3de Linuxu.<\/p>\n<p><noindex><noindex><\/p>\n<p><strong>AF_ALG<\/strong> \u2014 s\u00fa <a rel=\"nofollow\" href=\"https:\/\/www.kernel.org\/doc\/html\/v6.1\/crypto\/userspace-if.html\">pou\u017e\u00edvate\u013esk\u00e9 rozhranie<\/a> kryptografick\u00e9mu API jadra Linuxu. Prostredn\u00edctvom neho m\u00f4\u017eu programy pristupova\u0165 k realiz\u00e1ci\u00e1m \u0161ifrier, hashov a AEAD algoritmov v jadre ako k socketom. Dokument\u00e1cia Linuxu osobitne popisuje pre AF_ALG zero-copy re\u017eim cez splice() a vmsplice(), pri ktorom sa jadro sna\u017e\u00ed predch\u00e1dza\u0165 zbyto\u010dn\u00e9mu kop\u00edrovaniu d\u00e1t do pam\u00e4te jadra.<\/p>\n<p><\/noindex><\/noindex><\/p>\n<p><noindex><\/p>\n<p>Probl\u00e9m je v tom, \u017ee v pr\u00edpade AF_ALG sa tak\u00fdto v\u00fdkonov\u00fd zisk uk\u00e1zal ako nie tak\u00fd d\u00f4le\u017eit\u00fd, a rizik\u00e1 s\u00fa pr\u00edli\u0161 ve\u013ek\u00e9. Autor zmeny, v\u00fdvoj\u00e1r kryptografickej subsyst\u00e9my Linuxu Eric Biggers zo slu\u017eby Google, <a rel=\"nofollow\" href=\"https:\/\/lwn.net\/Articles\/1071203\/\">uviedol<\/a>, \u017ee zero-copy umo\u017e\u0148uje u\u017e\u00edvate\u013esk\u00e9mu priestoru vykon\u00e1va\u0165 kryptografick\u00e9 oper\u00e1cie priamo nad str\u00e1nkami page cache s\u00faborov, napr\u00edklad bin\u00e1rneho s\u00faboru su, a taktie\u017e vytv\u00e1ra podmienky pre zranite\u013enosti TOCTOU, ke\u010f sa pam\u00e4\u0165 m\u00f4\u017ee meni\u0165 s\u00fa\u010dasne s oper\u00e1ciou nad \u0148ou.<\/p>\n<p><\/noindex><\/p>\n<p>In\u00fdmi slovami, mechanizmus, ktor\u00fd je u\u017eito\u010dn\u00fd pri sie\u0165ovom alebo s\u00faborovom I\/O, sa v AF_ALG jav\u00ed ako pr\u00edli\u0161 nebezpe\u010dn\u00e1 optimaliz\u00e1cia. S\u00e1m AF_ALG, pod\u013ea slov v\u00fdvoj\u00e1ra, sa v s\u00fa\u010dasnosti z ve\u013ekej \u010dasti zachov\u00e1va pre sp\u00e4tn\u00fa kompatibilitu s mal\u00fdm s\u00faborom programov, ako je iwd, ktor\u00e9 e\u0161te neboli prelo\u017een\u00e9 na kryptografiu v u\u017e\u00edvate\u013eskom priestore. P\u00f4vodne bol AF_ALG navrhnut\u00fd aj na pr\u00edstup k hardv\u00e9rov\u00fdm kryptor\u00fdchlova\u010dom, ale v praxi sa uk\u00e1zal ako nie pr\u00edli\u0161 efekt\u00edvne rozhranie na tento \u00fa\u010del.<\/p>\n<p>Je d\u00f4le\u017eit\u00e9, \u017ee nejde o \u00fapln\u00e9 odstr\u00e1nenie splice() alebo sendfile() pre AF_ALG. Zmena je popisovan\u00e1 ako \u201ejemn\u00e9 rozbitie\u201c kompatibility: prenos d\u00e1t do AF_ALG po\u017eiadaviek cez splice() a sendfile() bude na\u010falej fungova\u0165, ale jadro teraz urob\u00ed intern\u00fa stabiln\u00fa k\u00f3piu d\u00e1t pred kryptografickou oper\u00e1ciou. V\u00fdkon sa v niektor\u00fdch pr\u00edpadoch m\u00f4\u017ee zn\u00ed\u017ei\u0165, no u\u017e\u00edvate\u013esk\u00e9 API sa form\u00e1lne nezlom\u00ed.<\/p>\n<p>Osobitne sa zd\u00f4raz\u0148uje, \u017ee zatia\u013e sa zero-copy odstra\u0148uje z <strong>skcipher<\/strong> a <strong>aead<\/strong>. Podpora pre typ <strong>hash<\/strong> sa bude posudzova\u0165 osobitne.<\/p>\n<p><noindex><\/p>\n<p>Kontext zmeny je nepr\u00edjemn\u00fd. Na konci apr\u00edla bola odhalen\u00e1 zranite\u013enos\u0165 <strong><a rel=\"nofollow\" href=\"https:\/\/xint.io\/blog\/copy-fail-linux-distributions\">Chyba kop\u00edrovania<\/a><\/strong> (<strong>CVE-2026-31431<\/strong>) v algif_aead, teda pr\u00e1ve v pou\u017e\u00edvate\u013eskom kryptointerface AF_ALG. V\u00fdskumn\u00edci uk\u00e1zali, \u017ee spojenie AF_ALG, splice() a \u0161peci\u00e1lnych vlastnost\u00ed AEAD-spracovania umo\u017enilo nepriviligovan\u00e9mu pou\u017e\u00edvate\u013eovi po\u0161kodzova\u0165 cache str\u00e1nok, vr\u00e1tane str\u00e1nok s\u00favisiacich s setuid-bin\u00e1rkami, a z\u00edska\u0165 zv\u00fd\u0161enie privil\u00e9gi\u00ed na \u00farove\u0148 root.<\/p>\n<p><\/noindex><br \/>\n<noindex><\/p>\n<p>Objavenie <a rel=\"nofollow\" href=\"https:\/\/www.sysdig.com\/blog\/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds\">Chyba kop\u00edrovania<\/a> bolo spojen\u00e9 s optimaliz\u00e1ciou z roku 2017, ktor\u00e1 previedla oper\u00e1cie AEAD na spracovanie \"na mieste\"; pri prenose s\u00faboru prostredn\u00edctvom splice() v AF_ALG jadro nepracovalo s k\u00f3piou, ale so sk\u00fa\u0161kami na str\u00e1nkach cache. V d\u00f4sledku toho sa \u010das\u0165 \u00fadajov, ktor\u00e9 sa pova\u017eovali za vstupn\u00e9, mohla ocitn\u00fa\u0165 v zapisovanom scatterliste.<\/p>\n<p><\/noindex><\/p>\n<p>Odstr\u00e1nenie zero-copy z AF_ALG nie je bodovou opravou len jednej zranite\u013enosti. Sk\u00f4r je to pokus odstr\u00e1ni\u0165 cel\u00e9 triedy rizikov\u00fdch scen\u00e1rov z m\u00e1lo pou\u017e\u00edvan\u00e9ho UAPI, kde v\u00fdhody z optimaliz\u00e1cie neospravedl\u0148uj\u00fa zlo\u017eitosti a potenci\u00e1lne n\u00e1sledky. Pre be\u017en\u00fdch pou\u017e\u00edvate\u013eov zmena pravdepodobne zostane nepozorovan\u00e1; pre zriedkav\u00e9 programy, ktor\u00e9 akt\u00edvne vyu\u017e\u00edvaj\u00fa AF_ALG prostredn\u00edctvom splice() alebo sendfile(), je mo\u017en\u00e9 pokles v\u00fdkonnosti v d\u00f4sledku dodato\u010dn\u00e9ho kop\u00edrovania.<\/p>\n<p>Zdroj: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/kernel\/18296321\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0443\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 cryptodev \u0438 \u043e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f \u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0432 \u043e\u043a\u043d\u043e \u0441\u043b\u0438\u044f\u043d\u0438\u044f Linux 7.2, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c\u0441\u044f \u0432 \u0438\u044e\u043d\u0435. \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0441\u0442\u0430\u043b\u0438 \u0440\u0430\u0441\u0442\u0443\u0449\u0438\u0435 \u043e\u043f\u0430\u0441\u0435\u043d\u0438\u044f \u0432\u043e\u043a\u0440\u0443\u0433 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 zero-copy-\u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0432 \u044f\u0434\u0440\u0435, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u0434\u0435 Linux. AF_ALG [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181666","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0418\u0437 AF_ALG \u0432 Linux \u0443\u0431\u0438\u0440\u0430\u044e\u0442 zero-copy \u0438\u0437 \u0441\u043e\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-22T16:25:08+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-22T16:25:08+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Z AF_ALG v Linuxe odstra\u0148uj\u00fa zero-copy z bezpe\u010dnostn\u00fdch d\u00f4vodov | ProHoster","description":"V subsyst\u00e9me kryptografie Linuxu sa pripravuje odstr\u00e1nenie podpory zero-copy z rozhrania AF_ALG pre typy algoritmov SKCIPHER a AEAD.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437 AF_ALG \u0432 Linux \u0443\u0431\u0438\u0440\u0430\u044e\u0442 zero-copy \u0438\u0437 \u0441\u043e\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-22T16:25:08+00:00","article:modified_time":"2026-05-22T16:25:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/181666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=181666"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/181666\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=181666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=181666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=181666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}