{"id":170863,"date":"2026-05-18T12:24:54","date_gmt":"2026-05-18T10:24:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root"},"modified":"2026-05-18T12:24:54","modified_gmt":"2026-05-18T10:24:54","slug":"v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","title":{"rendered":"N\u00eb Linux u zbulua nj\u00eb vulnerabilitet i ri LPE Fragnesia, i cili lejon nj\u00eb p\u00ebrdorues lokal t\u00eb fitoj\u00eb root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb l\u00ebvizje e re e cila zbulon nj\u00eb vulnerabilitet t\u00eb ngritjes s\u00eb privilegjeve lokale n\u00eb kernelin Linux, e cila \u00ebsht\u00eb quajtur Fragnesia<\/strong> dhe identifikatori CVE-2026-46300<\/strong>. Problemi i p\u00ebrket t\u00eb nj\u00ebjtit grup sulmesh n\u00eb cache-n\u00eb e faqes, sikur edhe Copy Fail dhe Dirty Frag q\u00eb jan\u00eb diskutuar s\u00eb fundmi, por nuk \u00ebsht\u00eb nj\u00eb ripublikim i nj\u00eb gabimi t\u00eb vjet\u00ebr: b\u00ebhet fjal\u00eb p\u00ebr nj\u00eb defekt t\u00eb ve\u00e7ant\u00eb n\u00eb kodin XFRM ESP-in-TCP<\/strong>.<\/p>\n

Vulnerabiliteti u zbulua nga hulumtuesi William Bowling<\/strong> nga ekipi V12 Security<\/strong>. Sipas p\u00ebrshkrimit t\u00eb botuar, Fragnesia lejon nj\u00eb p\u00ebrdorues lokal t\u00eb padeklaruar t\u00eb ndryshoj\u00eb p\u00ebrmbajtjen e skedar\u00ebve t\u00eb disponuesh\u00ebm vet\u00ebm p\u00ebr lexim, n\u00eb memorien e cache-n\u00eb e faqes dhe p\u00ebrmes k\u00ebsaj t\u00eb ekzekutoj\u00eb kod me t\u00eb drejtat e root. Ndryshe nga shum\u00eb eksploit\u00eb t\u00eb vjet\u00ebr LPE, sulmi nuk k\u00ebrkon nj\u00eb gar\u00eb dhe p\u00ebrshkruhet nga hulumtuesit si nj\u00eb ngjarje e p\u00ebrcaktuar.<\/p>\n

N\u00eb aspektin teknik, problemi lidhet me faktin se kur kombinohen buferat e rrjetit, kerneli mund t\u00eb ket\u00eb humbur shenj\u00ebn se nj\u00eb fragment i t\u00eb dh\u00ebnave \u00ebsht\u00eb \"i zakonsh\u00ebm\" dhe i lidhur me nj\u00eb faqe t\u00eb jashtme t\u00eb memories, duke p\u00ebrfshir\u00eb cache-n\u00eb e faqes. N\u00eb patchin e propozuar, kjo p\u00ebrshkruhet si nj\u00eb gabim n\u00eb skb_try_coalesce(): gjat\u00eb transferimit t\u00eb fragment\u00ebve t\u00eb paguar nga nj\u00eb sk_buff n\u00eb nj\u00eb tjet\u00ebr, flamuri SKBFL_SHARED_FRAG nuk u ruajt. Si rezultat, kodi m\u00eb von\u00eb i ESP mund t\u00eb konsideronte gabimisht buferin t\u00eb sigurt p\u00ebr modifikim.<\/p>\n

Efecti praktik \u00ebsht\u00eb se t\u00eb dh\u00ebnat, t\u00eb cilat ishin futur m\u00eb par\u00eb n\u00eb radh\u00ebn TCP nga nj\u00eb skedari, pas kalimit t\u00eb socketit n\u00eb modin espintcp, mund t\u00eb p\u00ebrpunoheshin nga kerneli si teksti i enkriptuar ESP. Kur dekriptohet AES-GCM, bajt\u00ebt ndryshohen drejtp\u00ebrs\u00ebdrejti n\u00eb faqen e cache-s lidhur me skedarin. Kjo nuk ndryshon skedarin n\u00eb disk, por e ndryshon p\u00ebrfaq\u00ebsimin e tij n\u00eb memorien deri n\u00eb zhvendosjen e faqes nga cache.<\/p>\n

N\u00eb demonstrat\u00ebn e botuar t\u00eb sulmit, si objektiv \u00ebsht\u00eb p\u00ebrdorur \/usr\/bin\/su: eksploit u modifikoi bajt\u00ebt e par\u00eb t\u00eb skedarit binar n\u00eb cache-n\u00eb e faqes dhe m\u00eb pas ekzekutoi kopjen e modifikuar n\u00eb memorien, duke fituar shell me t\u00eb drejtat e root. Skedari origjinal n\u00eb disk mbeti i pandryshuar, gj\u00eb q\u00eb e b\u00ebn problemin ve\u00e7an\u00ebrisht t\u00eb pak\u00ebndsh\u00ebm p\u00ebr diagnostikim: gjurm\u00ebt e shfryt\u00ebzimit mund t\u00eb zhduken pas pastrimit t\u00eb cache-s ose rinisjes.<\/p>\n

Fragnesia u shfaq m\u00eb pak se nj\u00eb jav\u00eb pas Dirty Frag. N\u00eb V12 theksohet se kjo \u00ebsht\u00eb nj\u00eb gabim i ve\u00e7ant\u00eb n\u00eb t\u00eb nj\u00ebjtin sip\u00ebrfaqe sulmi \u2014 ESP\/XFRM \u2014 dhe jo nj\u00eb riem\u00ebrtim i nj\u00eb dob\u00ebsie t\u00eb korrigjuar tashm\u00eb. Phoronix gjithashtu v\u00eb n\u00eb dukje se n\u00eb momentin e publikimit ishte n\u00eb dispozicion nj\u00eb prov\u00eb-koncesion, nd\u00ebrsa korrigjimi p\u00ebrb\u00ebnte nj\u00eb patch t\u00eb vog\u00ebl n\u00eb net\/core\/skbuff.c, q\u00eb nuk kishte arritur menj\u00ebher\u00eb n\u00eb deg\u00ebt kryesore t\u00eb b\u00ebrtham\u00ebs.<\/p>\n

<\/p>\n

Canonical i ka dh\u00ebn\u00eb CVE-2026-46300<\/a> prioritet t\u00eb lart\u00eb Ubuntu, duke e cituar arsye si \u00abeskalim trivial t\u00eb privilegjeve lokale\u00bb. N\u00eb faqen e Siguris\u00eb s\u00eb Ubuntu p\u00ebr b\u00ebrthamat e prekura n\u00eb momentin e p\u00ebrdit\u00ebsimit m\u00eb 13 maj sh\u00ebnjohej statusi \u00abN\u00eb vler\u00ebsim\u00bb, dhe n\u00eb sh\u00ebnimin p\u00ebrkat\u00ebs thuhet se problemi ndodhet gjithashtu n\u00eb modulin ESP t\u00eb b\u00ebrtham\u00ebs dhe mund t\u00eb zbutet p\u00ebrkoh\u00ebsisht n\u00eb t\u00eb nj\u00ebjt\u00ebn m\u00ebnyr\u00eb si Dirty Frag.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Debian Security Tracker<\/a> n\u00eb momentin e kontrollit sh\u00ebnonte b\u00ebrtham\u00ebn si t\u00eb prekura n\u00eb deg\u00ebt bullseye, bookworm, trixie, forky dhe sid; p\u00ebr paket\u00ebn linux n\u00eb unstable, versioni i rregulluar ende nuk ishte specifikuar.<\/p>\n

<\/noindex> <\/p>\n

Masa p\u00ebrkoh\u00ebsisht mbrojt\u00ebse mbetet e nj\u00ebjt\u00eb si p\u00ebr Dirty Frag: \u00e7aktivizoni ngarkimin e moduleve<\/a> esp4, esp6 dhe rxrpc, n\u00ebse ato nuk jan\u00eb t\u00eb nevojshme p\u00ebr sistemin. Kjo mund t\u00eb prish\u00eb funksionimin e tuneleve IPsec n\u00eb nyjet ku p\u00ebrdoren b\u00ebrthamat ESP, strongSwan, Libreswan ose konfigurime t\u00eb ngjashme, prandaj n\u00eb vendkalimet VPN nj\u00eb mas\u00eb e till\u00eb duhet t\u00eb aplikohet vet\u00ebm pas vler\u00ebsimit t\u00eb pasojave.<\/p>\n

<\/noindex> <\/p>\n

Nj\u00eb shembull i mas\u00ebs p\u00ebrkoh\u00ebsisht t\u00eb zbutjes p\u00ebr administrator\u00ebt:<\/p>\n

sudo sh -c "printf ‘install esp4 \/bin\/falseninstall esp6 \/bin\/falseninstall rxrpc \/bin\/falsen’ > \/etc\/modprobe.d\/dirtyfrag.conf" sudo rmmod esp4 esp6 rxrpc 2>\/dev\/null || true <\/p>\n

N\u00ebse ka dyshime se sistemi mund t\u00eb ket\u00eb qen\u00eb i sulmuar tashm\u00eb, vet\u00ebm bllokimi i moduleve nuk \u00ebsht\u00eb i mjaftuesh\u00ebm: p\u00ebr shkak se demonstrimi publik ndryshon skedarin ekzekutiv pik\u00ebrisht n\u00eb cache-n\u00eb e faqes, administrator\u00ebt rekomandojn\u00eb t\u00eb pastroni cache-n\u00eb e faqeve ose t\u00eb rinisni sistemin pas zbatimit t\u00eb masave mbrojt\u00ebse. CloudLinux e thekson qart\u00eb se pas shfryt\u00ebzimit \/usr\/bin\/su mund t\u00eb mbetet i ndryshuar n\u00eb memorie deri n\u00eb mbushjen e faqeve p\u00ebrkat\u00ebse.<\/p>\n

P\u00ebr t\u00eb hequr rregull\u00ebn p\u00ebrkoh\u00ebsisht pas instalimit t\u00eb b\u00ebrtham\u00ebs s\u00eb rregulluar, mund t\u00eb hiqni skedarin e krijuar:<\/p>\n

sudo rm \/etc\/modprobe.d\/dirtyfrag.conf <\/p>\n

Rekomandimi kryesor mbetet standart: instaloni b\u00ebrtham\u00ebn e rregulluar nga distribucioni juaj dhe rini sistemin. Deri n\u00eb p\u00ebrdit\u00ebsim, rreziku m\u00eb i lart\u00eb e kan\u00eb server\u00ebt multi-p\u00ebrdorues, CI-runners, ndarjet e shkall\u00ebs, fermat e nd\u00ebrtimit me kontejner\u00eb dhe \u00e7do makin\u00eb ku p\u00ebrdoruesit e pa privilegjuar ose pjes\u00ebrisht t\u00eb besuar mund t\u00eb ekzekutojn\u00eb kod lokal.<\/p>\n

Burimi: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Fragnesia \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2026-46300. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 page cache, \u0447\u0442\u043e \u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u0432\u0448\u0438\u0435\u0441\u044f Copy Fail \u0438 Dirty Frag, \u043d\u043e \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0441\u0442\u0430\u0440\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438: \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043e\u0431 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u043c \u0434\u0435\u0444\u0435\u043a\u0442\u0435 \u0432 \u043a\u043e\u0434\u0435 XFRM ESP-in-TCP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c William Bowling […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170863","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb Linux \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi e re LPE Fragnesia, q\u00eb lejon nj\u00eb p\u00ebrdorues lokal t\u00eb fitoj\u00eb akses root | ProHoster","description":"N\u00eb kernelin e Linux \u00ebsht\u00eb zbuluar nj\u00eb tjet\u00ebr dob\u00ebsi p\u00ebr rritjen lokale t\u00eb privilegjeve, e quajtur Fragnesia dhe e identifikuar me CVE-2026-46300.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Fragnesia, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Fragnesia \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2026-46300.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T10:24:54+00:00","article:modified_time":"2026-05-18T10:24:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/170863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=170863"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/170863\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=170863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=170863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=170863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}