{"id":172665,"date":"2026-05-19T00:24:34","date_gmt":"2026-05-18T22:24:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-19T00:24:34","modified_gmt":"2026-05-18T22:24:34","slug":"dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"DirtyDecrypt \u2014 jo\u0161 jedna ranjivost klase Copy Fail koja omogu\u0107ava root pristup u Linuxu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V jedru Linux je bila odkrita ranljivost, podobna ranljivostim Copy Fail, Dirty Frag in Fragnesia, ki omogo\u010da neprivilegiranemu uporabniku pridobitev pravic root z nadpisovanjem podatkov v strani\u0161\u010dnem predpomnilniku. Ranljivosti je dodeljeno kodno ime DirtyDecrypt (te\u017eava se prav tako omenja pod imenom DirtyCBC). Na voljo je prototip izkori\u0161\u010danja. <\/p>\n

CVE-identifikator v opombi k izkori\u0161\u010danju ni omenjeno, navedeno je le, da so raziskovalci te\u017eavo odkrili 9. maja, nakar so obvestili razvijalce jedra, ki so odgovorili, da njihovo odkritje podvoji drugo poro\u010dilo o \u017ee odpravljeni ranljivosti. Ker je bil popravek \u017ee vklju\u010den v jedro, so se raziskovalci odlo\u010dili objaviti razvito izkori\u0161\u010danje. Sode\u010d po opisu znotraj izkori\u0161\u010danja, se pri njem uporablja ranljivost CVE-2026-31635, za katero je bilo popravilo sprejeto v jedro aprila in vklju\u010deno v razli\u010dico 7.0.0 ter oblikovano 18. aprila s sprostitvijo 6.18.23. Te\u017eava se ka\u017ee od jedra 6.16 naprej. <\/p>\n

Kot v primeru ranljivosti Dirty Frag tudi nova ranljivost obstaja v gonilniku RxRPC, ki implementira dru\u017eino socketov AF_RXRPC in istoimenski RPC protokol, ki deluje nad UDP. Te\u017eava je posledica napake pri preverjanju velikosti podatkov v funkciji rxgk_verify_response() \u2014 namesto preverjanja \u201eif (auth_len > len)\u201d je bil v kodi naveden \u201eif (auth_len < len)\u201d, kar je privedlo do prenosa podatkov z ve\u010djo velikostjo kot je dovoljeno v funkcijo rxgk_decrypt_skb(). Pri izvedbi funkcije rxgk_decrypt_skb() se je dekripcija podatkov izvajala z neposrednim prikazovanjem sprememb v strani\u0161nem predpomnilniku, da bi se izognili odve\u010dni predobdelavi. Zaradi napa\u010dnega preverjanja velikosti je pri\u0161lo do mo\u017enosti prepisovanja podatkov v strani\u0161nem predpomnilniku na izbrano premico. <\/p>\n

Izkori\u0161\u010danje ranljivosti se omejuje na branje datoteke programa s suid root oznako (da bi se ta shranila v strani\u0161nem predpomnilniku) in zamenjavo dela kode programa v strani\u0161nem predpomnilniku s kodo za zagon \/usr\/bin\/sh. Nadaljnje zagon programa bo povzro\u010dil, da se bo v pomnilniku nalo\u017eila ne originalna izvr\u0161ljiva datoteka z naprave, temve\u010d spremenjena kopija iz strani\u010dnega predpomnilnika. Kot suid programe v izkori\u0161\u010danju je predvidena mo\u017enost uporabe \u201e\/usr\/bin\/su\u201d, \u201e\/bin\/su\u201d, \u201e\/usr\/bin\/mount\u201d, \u201e\/usr\/bin\/passwd\u201d in \u201e\/usr\/bin\/chsh\u201d. <\/p>\n

Za izkori\u0161\u010danje ranljivosti mora biti pri sestavljanju jedra aktivna mo\u017enost CONFIG_RXGK, modul jedra rxrpc.ko pa mora biti na voljo za samodejno nalaganje (v nekaterih sistemih se ne sestavlja). Status odprave ranljivosti v distribucijah lahko ocenite na naslednjih straneh: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Arch, Fedora. Kot obvodno za\u0161\u010dito lahko blokirate nalaganje modula jedra rxrpc: <\/p>\n

sh -c \u201eprintf 'install rxrpc \/bin\/false\n' > \/etc\/modprobe.d\/dirtydecrypt.conf; rmmod rxrpc 2>\/dev\/null; true\u201d <\/p>\n

Dodatno lahko omenimo objavo v mailing listi razvijalcev jedra Linux popravkov, ki popolnoma onemogo\u010dajo optimizacije v crypto API (AF_ALG), ki uporabljajo neposreden dostop do strani\u010dnega predpomnilnika pri dekripciji z uporabo algoritmov \u201eskcipher\u201d in \u201eaead\u201d. Optimizacije izklju\u010dujejo odve\u010dno predobdelavo podatkov, vendar ustvarjajo tveganja za resne ranljivosti. Predpostavlja se, da bo njihovo onemogo\u010danje privedlo le do rahlega upada zmogljivosti zaradi pojava dodatne operacije kopiranja v lo\u010den predpomnilnik. Popravki so sprejeti s strani vzdr\u017eevalca podsistema crypto API in vklju\u010deni v vejo \u201ecryptodev\u201d, v kateri se razvijajo mo\u017enosti za prenos v osnovno sestavo prihodnjih izdaj jedra Linux.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Copy Fail, Dirty Frag \u0438 Fragnesia \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f DirtyDecrypt (\u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u0438\u043c\u0435\u043d\u0435\u043c DirtyCBC). \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0432 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0438 \u043a \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0443 \u043d\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043e \u043b\u0438\u0448\u044c, \u0447\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 9 \u043c\u0430\u044f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DirtyDecrypt \u2014 nova ranljivost razreda Copy Fail, ki omogo\u010da pridobitev pravic root v Linuxu | ProHoster","description":"V jedru Linux je bila odkrito ranljivost, podobna ranljivostim Copy Fail, Dirty Frag in Fragnesia, ki neprivilegiranemu uporabniku omogo\u010da pridobitev pravic root, ker zapi\u0161e podatke v strani\u0161ki predpomnilnik.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DirtyDecrypt \u2014 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u0430 Copy Fail, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0430\u0432\u0430 root \u0432 Linux | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Copy Fail, Dirty Frag \u0438 Fragnesia \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/dirtydecrypt-ocherednaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T22:24:34+00:00","article:modified_time":"2026-05-18T22:24:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/172665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=172665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/172665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=172665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=172665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=172665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}