Vatsvagiri vezvekuchengetedza kubva kuGoogle vakawana kusasimba mu kernel Linux Pane mukana wekuwedzera rusununguko (CVE-2025-38236). Pakati pezvimwe zvinhu, rusununguko urwu runobvumira kuyambuka nzira yekubvisa sandbox inoshandiswa muGoogle Chrome uye kuwana kernel-level code execution pakushandisa kodhi mumamiriro ezvinhu eChrome's sandboxed rendering process (semuenzaniso, nekushandisa imwe disablement muChrome). Dambudziko iri rinotanga kubva mukernel. Linux 6.9 uye yakagadziriswa mu kernel updates Linux 6.1.143, 6.6.96, 6.12.36 uye 6.15.5. Muenzaniso wekushandiswa unowanikwa kuti udhawunirodhwe.
Kukuvara uku kunokonzerwa nekukanganisa kwekushandiswa kwemureza weMSG_OOB, unogona kuiswa kune masoketi eAF_UNIX. Mureza weMSG_OOB ("kunze kwebhendi") unobvumira imwe byte kuti iwedzere kune data riri kutumirwa, iro mugamuchiri anogona kuverenga asati agamuchira data rese. Mureza uyu wakawedzerwa kune kernel. Linux 5.15 yakakumbirwa neOracle uye yakakurudzirwa kuti isashandiswe gore rapfuura sezvo isina kugamuchirwa zvakanyanya.
Kuitwa kwebhokisi rejecha reChrome kwakabvumira UNIX socket mashandiro uye kutumira()/recv() system kufona uko mureza weMSG_OOB waitenderwa pamwe chete nedzimwe sarudzo uye hauna kusefa zvakasiyana. Chipembenene chiri muMSG_OOB kuita chinobvumira kuti kushandiswa-mushure-kwemahara kuitike mushure mekuita imwe nhevedzano yenharembozha: char dummy; masokisi[2]; socketpair(AF_UNIX, SOCK_STREAM, 0, masokisi); send(masokisi[1], "A", 1, MSG_OOB); recv(masokisi[0], &dummy, 1, MSG_OOB); send(masokisi[1], "A", 1, MSG_OOB); recv(masokisi[0], &dummy, 1, MSG_OOB); send(masokisi[1], "A", 1, MSG_OOB); recv(masokisi[0], &dummy, 1, 0); recv(masokisi[0], &dummy, 1, MSG_OOB);
Source: opennet.ru
