{"id":182332,"date":"2026-06-27T08:48:07","date_gmt":"2026-06-27T06:48:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha"},"modified":"2026-06-27T08:48:07","modified_gmt":"2026-06-27T06:48:07","slug":"pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha","title":{"rendered":"PEdit-CoW a DirtyClone \u2014 zranite\u013enosti v jadre Linuxu, ktor\u00e9 umo\u017e\u0148uj\u00fa z\u00edska\u0165 root pr\u00edstup cez \u00fapravu str\u00e1nkov\u00e9ho cache","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Boli odhalen\u00e9 inform\u00e1cie o dvoch nov\u00fdch zranite\u013enostiach v jadre syst\u00e9mu Linux, ktor\u00e9 umo\u017e\u0148uj\u00fa neprivilegovan\u00e9mu pou\u017e\u00edvate\u013eovi z\u00edska\u0165 pr\u00e1va roota prep\u00edsan\u00edm \u00fadajov v str\u00e1nkovom cache. Pre obe zranite\u013enosti s\u00fa pripraven\u00e9 funk\u010dn\u00e9 exploit\u00e1cie.<\/p>\n
\n
PEdit-CoW (CVE-2026-46331, exploit 1, exploit 2) \u2014 chyba pri aplik\u00e1cii mechanizmu copy-on-write v k\u00f3de na zmenu hlavi\u010diek paketov (act_pedit), ktor\u00fd sa pou\u017e\u00edva v pl\u00e1nova\u010di sie\u0165ov\u00fdch paketov (net\/sched), umo\u017e\u0148uje z\u00e1pis d\u00e1t mimo pridelen\u00e9ho vyrovn\u00e1vacieho priestoru, \u010do m\u00f4\u017ee by\u0165 vyu\u017eit\u00e9 na prep\u00edsanie d\u00e1t vo str\u00e1nkovom cache na zvolenom posune. Chyba je sp\u00f4soben\u00e1 t\u00fdm, \u017ee kontrola povolen\u00fdch oblast\u00ed pre z\u00e1pis d\u00e1t sa vykon\u00e1vala bez oh\u013eadu na to, \u017ee posun na editovate\u013en\u00e9 polia sa m\u00f4\u017ee po\u010das vykon\u00e1vania oper\u00e1cie zmeni\u0165.\n
Probl\u00e9m sa prejavuje od jadra Linux 5.18 a bol odstr\u00e1nen\u00fd vo verzi\u00e1ch 7.1, 7.0.13, 6.18.36 a 6.12.94. Je ozn\u00e1men\u00e1 mo\u017enos\u0165 zneu\u017eitia probl\u00e9mu v RHEL 8\/9\/10, Debian 11\/12, openSUSE Leap 15.6, SUSE Linux 15-SP7\/16.0 a Ubuntu 18.04-25.10 (v verzii Ubuntu 26.4 je predvolene zablokovan\u00e9 vytvorenie user namespace). Ako obch\u00e1dzaj\u00face opatrenie sa odpor\u00fa\u010da zablokova\u0165 na\u010d\u00edtanie modulu jadra act_pedit (prestane fungova\u0165 pravidl\u00e1 obmedzovania prev\u00e1dzky a prep\u00edsanie hlavi\u010diek cez \u201etc pedit\u201c).<\/p>\n
DirtyClone (CVE-2026-43503, exploit) \u2014 obch\u00e1dzaj\u00faci sp\u00f4sob zneu\u017eitia zranite\u013enosti Dirty Frag v module xfrm-ESP, ktor\u00fd sa pou\u017e\u00edva na ur\u00fdchlenie oper\u00e1ci\u00ed \u0161ifrovania v IPsec s pou\u017eit\u00edm protokolu ESP (Encapsulating Security Payload). Na klonovanie \u0161trukt\u00fary skb v novom exploite sa pou\u017e\u00edva manipul\u00e1cia s TEE-roz\u0161\u00edren\u00edm k netfilter (modul xt_TEE), ktor\u00fd vykon\u00e1va oper\u00e1ciu klonovania sie\u0165ov\u00fdch paketov.\n
Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 vo verzi\u00e1ch jadra Linux 7.1, 7.0.10, 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91 a 6.18.33. Probl\u00e9m sa prejavuje v Debian, Ubuntu, Fedora, \nRHEL a SUSE. Ako obch\u00e1dzaj\u00face opatrenie na zablokovanie zranite\u013enosti je mo\u017en\u00e9 zak\u00e1za\u0165 na\u010d\u00edtanie modulov jadra esp4 a esp6.<\/p>\n<\/ul>\n
Na zneu\u017eitie oboch zranite\u013enost\u00ed s\u00fa potrebn\u00e9 pr\u00edstupov\u00e9 pr\u00e1va CAP_NET_ADMIN, ktor\u00e9 m\u00f4\u017ee nepovinovan\u00fd pou\u017e\u00edvate\u013e z\u00edska\u0165 prostredn\u00edctvom vytvorenia priestorov identifika\u010dn\u00fdch \u010d\u00edsel pou\u017e\u00edvate\u013eov (user namespace). V Ubuntu je podobn\u00e1 oper\u00e1cia predvolene zak\u00e1zan\u00e1, ale m\u00f4\u017ee by\u0165 povolen\u00e1 cez sysctl \u201ekernel.apparmor_restrict_unprivileged_userns=0\u201c alebo profily AppArmor. V ostatn\u00fdch distrib\u00faci\u00e1ch dostupnos\u0165 \u201euser namespace\u201c nepovinovan\u00fdm pou\u017e\u00edvate\u013eom z\u00e1vis\u00ed od nastavenia sysctl \u201ekernel.unprivileged_userns_clone\u201c (ak je 0, je zak\u00e1zan\u00e9). <\/p>\n
Zneu\u017e\u00edvanie zranite\u013enost\u00ed spo\u010d\u00edva v \u010d\u00edtan\u00ed s\u00faboru programu \/bin\/su s flagom suid root, aby sa ulo\u017eil do str\u00e1nkov\u00e9ho cache a nahradil \u010das\u0165 k\u00f3du programu k\u00f3dom na spustenie \/bin\/sh v str\u00e1nkovom cache. N\u00e1sledn\u00e9 spustenie programu sp\u00f4sob\u00ed, \u017ee sa do pam\u00e4te na\u010d\u00edta nie p\u00f4vodn\u00fd spustite\u013en\u00fd s\u00fabor z \u00falo\u017eiska, ale upraven\u00e1 k\u00f3pia zo str\u00e1nkov\u00e9ho cache. <\/p>\n
Je tie\u017e mo\u017en\u00e9 spomen\u00fa\u0165 vytvorenie exploit pre zranite\u013enos\u0165 CVE-2026-23111 v subsyst\u00e9me nf_tables, ktor\u00e1 bola odstr\u00e1nen\u00e1 vo febru\u00e1rov\u00fdch aktualiz\u00e1ci\u00e1ch jadra Linux. Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 pr\u00edstupom k pam\u00e4ti po jej uvo\u013enen\u00ed (use-after-free) a umo\u017e\u0148uje neprivilegovan\u00e9mu pou\u017e\u00edvate\u013eovi z\u00edska\u0165 pr\u00e1va root v syst\u00e9me. Aby mohlo d\u00f4js\u0165 k \u00fatoku, mus\u00ed ma\u0165 pou\u017e\u00edvate\u013e mo\u017enos\u0165 vytv\u00e1ra\u0165 u\u017e\u00edvate\u013esk\u00e9 menov\u00e9 priestory (user namespace). Fungovanie exploitu bolo demon\u0161trovan\u00e9 v \nDebian 12\/13 a Ubuntu 22.04\/24.04. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"