N\u00eb kernelin Linux \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi, duke u ngjashme me dob\u00ebsit\u00eb Copy Fail, Dirty Frag dhe Fragnesia, e cila lejon nj\u00eb p\u00ebrdorues jo privilegjuar t\u00eb fitoj\u00eb t\u00eb drejta root duke ri-shkruar t\u00eb dh\u00ebnat n\u00eb cache-n e faqeve. Dob\u00ebsive i \u00ebsht\u00eb dh\u00ebn\u00eb emri kodik DirtyDecrypt (problemi gjithashtu p\u00ebrmendet si DirtyCBC). Nj\u00eb prototip eksploit \u00ebsht\u00eb n\u00eb dispozicion. <\/p>\n
CVE-identifikatori nuk p\u00ebrmendet n\u00eb sh\u00ebnimin e eksploitit, \u00ebsht\u00eb vet\u00ebm e p\u00ebrmendur se studiuesit zbuluan problemin m\u00eb 9 maj, pas s\u00eb cil\u00ebs ata iu njoftuan zhvilluesve t\u00eb kernelit, t\u00eb cil\u00ebt p\u00ebrgjigj\u00ebn se zbulimi i tyre \u00ebsht\u00eb nj\u00eb kopje e nj\u00eb raporti tjet\u00ebr mbi nj\u00eb dob\u00ebsi q\u00eb kishte tashm\u00eb nj\u00eb zgjidhje. Nd\u00ebrkoh\u00eb q\u00eb patchi me zgjidhjen tashm\u00eb \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb kernel, studiuesit vendos\u00ebn t\u00eb publikojn\u00eb eksploitin e zhvilluar prej tyre. Sipas p\u00ebrshkrimit brenda eksploitit, ai p\u00ebrdor dob\u00ebsin\u00eb CVE-2026-31635, p\u00ebr t\u00eb cil\u00ebn ishte pranuar nj\u00eb zgjidhje n\u00eb kernel n\u00eb prill dhe ishte p\u00ebrfshir\u00eb n\u00eb versionin 7.0.0 t\u00eb formuar m\u00eb 18 prill 6.18.23. Problemi shfaqet duke filluar nga kernel 6.16. <\/p>\n
As with the Dirty Frag vulnerability series, the new vulnerability exists in the RxRPC driver, which implements the AF_RXRPC socket family and the namesake RPC protocol operating over UDP. The issue arises from an error in the data size verification in the rxgk_verify_response() function \u2014 instead of checking 'if (auth_len > len)', the code incorrectly specified 'if (auth_len < len)', leading to the passing of data larger than allowed to the rxgk_decrypt_skb() function. In performing the rxgk_decrypt_skb() function, data decryption was carried out by directly substituting changes into the page cache to avoid unnecessary buffering. Due to the incorrect size check, there was potential for data overwrite in the page cache at the chosen offset. <\/p>\n
Exploitation of the vulnerability involves reading a program file with the suid root flag (to place it in the page cache) and replacing part of the program's code in the page cache with code to launch \/usr\/bin\/sh. The subsequent execution of the program will result in loading not the original executable file from storage into memory, but a modified copy from the page cache. As suid programs, the exploit allows for the use of '\/usr\/bin\/su', '\/bin\/su', '\/usr\/bin\/mount', '\/usr\/bin\/passwd', and '\/usr\/bin\/chsh'. <\/p>\n
P\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebt\u00eb vulnerabilitet, duhet t\u00eb jet\u00eb aktive opsioni CONFIG_RXGK gjat\u00eb nd\u00ebrtimit t\u00eb kerneli dhe moduli i kernelit rxrpc.ko duhet t\u00eb jet\u00eb n\u00eb dispozicion p\u00ebr ngarkim automatik (n\u00eb disa sisteme ai nuk grumbullohet). Statusi i eliminimit t\u00eb vulnerabiliteteve n\u00eb shp\u00ebrndarjet mund t\u00eb vler\u00ebsohet n\u00eb k\u00ebto faqe: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Arch, Fedora. Si nj\u00eb m\u00ebnyr\u00eb mbrojt\u00ebse, mund t\u00eb bllokohet ngarkimi i modulit t\u00eb kernelit rxrpc: <\/p>\n
sh -c 'printf 'install rxrpc \/bin\/false\n' > \/etc\/modprobe.d\/dirtydecrypt.conf; rmmod rxrpc 2>\/dev\/null; true' <\/p>\n