{"id":172668,"date":"2026-05-19T06:24:52","date_gmt":"2026-05-19T04:24:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly"},"modified":"2026-05-19T12:52:18","modified_gmt":"2026-05-19T10:52:18","slug":"v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","title":{"rendered":"N\u00eb Linux \u00ebsht\u00eb mbyllur vulnerabiliteti ssh-keysign-pwn, q\u00eb lejon p\u00ebrdoruesit lokal\u00eb t\u00eb lexojn\u00eb skedar\u00ebt root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb vulnerabilitet n\u00eb kernelin Linux \u00ebsht\u00eb rregulluar, i njohur si ssh-keysign-pwn<\/strong>. Problemi lejon nj\u00eb p\u00ebrdorues lokal pa privilegje t\u00eb lexoj\u00eb skedar\u00eb q\u00eb duhet t\u00eb jen\u00eb t\u00eb accesuesh\u00ebm vet\u00ebm nga root, duke p\u00ebrfshir\u00eb \u00e7el\u00ebsat privat\u00eb SSH host, dhe, n\u00eb disa skenare, \/etc\/shadow. N\u00eb momentin e publikimit, nj\u00eb CVE i ve\u00e7ant\u00eb p\u00ebr k\u00ebt\u00eb problem ende nuk ishte caktuar.<\/p>\n

<\/p>\n

Megjith\u00ebse emri sugjeron ndryshe, problemi nuk \u00ebsht\u00eb nj\u00eb defekt n\u00eb OpenSSH si nj\u00eb server n\u00eb rrjet sshd, por nj\u00eb defekt<\/a> n\u00eb logjik\u00ebn e kernelit Linux, lidhur me verifikimet ptrace dhe aksesin n\u00eb deshkriptor\u00ebt e skedar\u00ebve t\u00eb nj\u00eb procesi tjet\u00ebr p\u00ebrmes pidfd_getfd(2). Mjeti OpenSSH ssh-keysign doli t\u00eb ishte nj\u00eb nga shembujt e duhura p\u00ebr shfryt\u00ebzim, sepse punon me \u00e7el\u00ebsat privat\u00eb host, t\u00eb cil\u00ebt zakonisht jan\u00eb n\u00eb pron\u00ebsi t\u00eb root dhe nuk jan\u00eb t\u00eb aksesuesh\u00ebm nga p\u00ebrdoruesit e zakonsh\u00ebm.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Thelbi i problemit<\/a> \u00ebsht\u00eb se funksioni __ptrace_may_access() p\u00ebrpunonte n\u00eb m\u00ebnyr\u00eb t\u00eb gabuar gjendjen e procesit, t\u00eb cilit tashm\u00eb i kishte humbur struktura e memories mm, por ende kishte deshkriptor\u00eb skedar\u00ebsh aktiv\u00eb. Gjat\u00eb p\u00ebrfundimit t\u00eb procesit, kernel-i th\u00ebrret exit_mm() p\u00ebrpara se t\u00eb mbyll\u00eb skedar\u00ebt p\u00ebrmes exit_files(). N\u00eb k\u00ebt\u00eb interval t\u00eb shkurt\u00ebr, procesi duket si t\u00eb mos ket\u00eb nj\u00eb hap\u00ebsir\u00eb adresimi t\u00eb zakonshme p\u00ebrdoruesi, por skedar\u00ebt e tij t\u00eb hapur ende ekzistojn\u00eb. P\u00ebr k\u00ebt\u00eb arsye, kontrolli i statusit 'dumpable' mund t\u00eb anashkalohej, dhe pidfd_getfd() mund t\u00eb fitonte akses n\u00eb nj\u00eb deshkriptor skedari t\u00eb huaj me UID q\u00eb p\u00ebrputhet.<\/p>\n

<\/noindex> <\/p>\n

Nj\u00eb skenar praktik nd\u00ebrtuar rreth programeve setuid, t\u00eb cilat fillimisht hapin nj\u00eb skedar t\u00eb ndjesh\u00ebm me t\u00eb drejta root, pastaj heqin privilegjet dhe p\u00ebrfundojn\u00eb, duke mbajtur ende nj\u00eb deshkriptor t\u00eb hapur. N\u00eb p\u00ebrshkrimin e botuar, si nj\u00eb shembull p\u00ebrmendet ssh-keysign: ai hap \/etc\/ssh\/ssh_host_{ecdsa,ed25519,rsa}_key, pas t\u00eb cilit heq t\u00eb drejtat dhe mund t\u00eb p\u00ebrfundoj\u00eb, n\u00ebse EnableSSHKeysign \u00ebsht\u00eb \u00e7aktivizuar. K\u00ebta \u00e7el\u00ebsa duhet t\u00eb jen\u00eb n\u00eb dispozicion vet\u00ebm p\u00ebr root, pasi p\u00ebrdoren p\u00ebr autentifikimin e bazuar n\u00eb host.<\/p>\n

Nj\u00eb shembull tjet\u00ebr \u00ebsht\u00eb chage, e cila mund t\u00eb hap\u00eb \/etc\/shadow, pastaj t\u00eb heq\u00eb t\u00eb drejtat efektive dhe t\u00eb p\u00ebrfundoj\u00eb. Si rezultat, sulmi nuk jep domosdoshm\u00ebrisht menj\u00ebher\u00eb nj\u00eb shell me t\u00eb drejta root, por lejon qasjen n\u00eb p\u00ebrmbajtjen e skedar\u00ebve, e cila zakonisht konsiderohet tejet sekret. Rrjedhja e \/etc\/shadow \u00ebsht\u00eb e rrezikshme p\u00ebr mund\u00ebsin\u00eb e nj\u00eb p\u00ebrzgjedhjeje offline t\u00eb fjal\u00ebkalimeve, nd\u00ebrsa rrjedhja e \u00e7el\u00ebsave privat\u00eb SSH host p\u00ebrb\u00ebn rrezik p\u00ebr zmadhimin e hostit ose p\u00ebr kryerjen e sulmeve n\u00eb skenar\u00ebt e besuar SSH.<\/p>\n

Korrektimi tashm\u00eb \u00ebsht\u00eb pranuar n\u00eb deg\u00ebn kryesore t\u00eb Linux-it. Komiti 31e62c2ebbfd me titullin ptrace: logjika 'get_dumpable()' m\u00eb e arsyeshme ndryshon sjelljen e kontrollit t\u00eb dumpability-t: kernel-i tani ruan gjendjen user_dumpable n\u00eb munges\u00eb t\u00eb mm dhe k\u00ebrkon nj\u00eb kontroll t\u00eb sakt\u00eb t\u00eb CAP_SYS_PTRACE p\u00ebr kalimin. Patch-i prek include\/linux\/sched.h, kernel\/exit.c dhe kernel\/ptrace.c.<\/p>\n

Vulnerabiliteti u raportua nga Qualys dhe u rregullua nga Linus Torvalds m\u00eb 14 maj 2026. Phoronix thekson se n\u00eb momentin e publikimit, problemi prek t\u00eb gjitha l\u00ebshimet e b\u00ebrtham\u00ebs Linux deri n\u00eb gjendjen aktuale t\u00eb pem\u00ebs mainline para se t\u00eb b\u00ebhej rregullimi. Autori i PoC po ashtu n\u00ebnvizon se b\u00ebrthamat deri n\u00eb komitin 31e62c2ebbfd jan\u00eb vulnerab\u00ebl, duke p\u00ebrfshir\u00eb deg\u00ebt stabile n\u00eb dat\u00ebn 14 maj.<\/p>\n

<\/p>\n

\u00cbsht\u00eb ve\u00e7an\u00ebrisht e r\u00ebnd\u00ebsishme q\u00eb p\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebt\u00eb nuk k\u00ebrkohet ngarkimi i moduleve specifike t\u00eb b\u00ebrtham\u00ebs, si n\u00eb disa vulnerabilitete t\u00eb fundit t\u00eb LPE. Mjafton nj\u00eb qasje lokale jo privilegjuese n\u00eb sistem dhe nj\u00eb proces ndihm\u00ebs t\u00eb privilegjuar t\u00eb p\u00ebrshtatsh\u00ebm. Zhvilluesi i Debian, Daniel Baumann, theksoi<\/a>, se ky problem duhet t\u00eb adresohen me p\u00ebrdit\u00ebsimin e b\u00ebrtham\u00ebs dhe rindizjen n\u00eb b\u00ebrtham\u00ebn e rregulluar.<\/p>\n

<\/noindex> <\/p>\n

N\u00eb depot e publikuara me demonstrim \u00ebsht\u00eb deklaruar kontrolli n\u00eb Raspberry Pi OS Bookworm me b\u00ebrtham\u00ebn 6.12.75, Debian 13, Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04, Arch dhe CentOS 9. Ky list\u00eb duhet marr\u00eb si t\u00eb dh\u00ebnat e autorit t\u00eb PoC, dhe jo si nj\u00eb list\u00eb p\u00ebrfundimtare: p\u00ebr shkak se gabimi ndodhet n\u00eb logjik\u00ebn e zakonshme t\u00eb b\u00ebrtham\u00ebs, mbulimi faktik varet nga versioni i b\u00ebrtham\u00ebs dhe ekzistenca e rregullimit backport n\u00eb shp\u00ebrndarjen specifike.<\/p>\n

P\u00ebr administrator\u00ebt, rekomandimi kryesor \u00ebsht\u00eb i thjesht\u00eb: instaloni paket\u00ebn e p\u00ebrdit\u00ebsuar t\u00eb b\u00ebrtham\u00ebs nga shp\u00ebrndarja juaj dhe rindizni sistemin. N\u00ebse ka arsye p\u00ebr t\u00eb besuar se makineria ka patur qasje lokale jo privilegjuese nga nj\u00eb sulmues, pas p\u00ebrdit\u00ebsimit \u00ebsht\u00eb e arsyeshme t\u00eb shqyrtohet rotacioni i \u00e7el\u00ebsave t\u00eb host-SSH dhe verifikimi i \/etc\/shadow\/llogarive, pasi vulnerabiliteti lidhet pik\u00ebrisht me leximin e skedar\u00ebve t\u00eb ndjesh\u00ebm, dhe jo vet\u00ebm me kalimin e kontrollit t\u00eb aksesit.<\/p>\n

N\u00eb Debian ka filluar puna p\u00ebr transferimin e rregullimit: Baumann njoftoi p\u00ebr cherry-pick t\u00eb komitit upstream n\u00eb trixie-fastforward-backports dhe p\u00ebr d\u00ebrgimin e k\u00ebrkes\u00ebs p\u00ebr bashkimin p\u00ebr Debian sid. N\u00eb k\u00ebrkes\u00ebn p\u00ebr bashkim \u00ebsht\u00eb sh\u00ebnuar qart\u00eb se po transferohet komiti 31e62c2 p\u00ebr rregullimin e logjik\u00ebs ptrace t\u00eb dumpability-t, duke lejuar leximin e skedar\u00ebve root nga nj\u00eb p\u00ebrdorues pa privilegje.<\/p>\n

Burimi: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0447\u0438\u0442\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e root, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 SSH host-\u043a\u043b\u044e\u0447\u0438 \u0438, \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445, \/etc\/shadow. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 CVE \u0434\u043b\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0435\u0449\u0451 \u043d\u0435 \u0431\u044b\u043b \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d. \u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435, \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043d\u0435 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 OpenSSH \u043a\u0430\u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172668","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb Linux u mbyll vunerabiliteti ssh-keysign-pwn, i cili lejon p\u00ebrdoruesit lokal\u00eb t\u00eb lexojn\u00eb skedar\u00ebt root | ProHoster","description":"N\u00eb b\u00ebrtham\u00ebn Linux u rregullua nj\u00eb vunerabilitet, i njohur joformalisht si ssh-keysign-pwn.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c ssh-keysign-pwn, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0447\u0438\u0442\u0430\u0442\u044c root-\u0444\u0430\u0439\u043b\u044b | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ssh-keysign-pwn.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-linux-zakryta-uyazvimost-ssh-keysign-pwn-pozvolyayushhaya-lokalnym-polzovatelyam-chitat-root-fajly","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-19T04:24:52+00:00","article:modified_time":"2026-05-19T10:52:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/172668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=172668"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/172668\/revisions"}],"predecessor-version":[{"id":172737,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/172668\/revisions\/172737"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=172668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=172668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=172668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}