{"id":172753,"date":"2026-05-19T18:24:36","date_gmt":"2026-05-19T16:24:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-19T18:24:36","modified_gmt":"2026-05-19T16:24:36","slug":"pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"PinTheft \u2014 dob\u00ebsia e gjasht\u00eb e klas\u00ebs Copy Fail, e cila ofron t\u00eb drejtat root n\u00eb Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Informacioni i zbulimi mbi nj\u00eb dob\u00ebsi t\u00eb gjasht\u00eb (1, 2-3, 4, 5) q\u00eb lejon nj\u00eb p\u00ebrdorues lokal pa privilegje t\u00eb fitoj\u00eb t\u00eb drejtat root duke rishkruar t\u00eb dh\u00ebna n\u00eb cache-n\u00eb e faqes. Kjo dob\u00ebsi ka emrin kodues PinTheft. Nj\u00eb prototip i eksploitatit \u00ebsht\u00eb n\u00eb dispozicion. Identifikuesi CVE ende nuk \u00ebsht\u00eb caktuar. Nj\u00eb zgjidhje \u00ebsht\u00eb n\u00eb dispozicion n\u00eb form\u00ebn e nj\u00eb patch-i, i cili u publikua m\u00eb 5 maj dhe u pranua n\u00eb deg\u00ebn netdev m\u00eb 11 maj, por nuk \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb l\u00ebshimet korrektuese t\u00eb b\u00ebrtham\u00ebs. <\/p>\n
Dob\u00ebsia \u00ebsht\u00eb e pranishme n\u00eb implementimin e protokollit rrjet RDS (Reliable Datagram Sockets), i cili \u00ebsht\u00eb i destinuar p\u00ebr shk\u00ebmbimin e shpejt\u00eb t\u00eb mesazheve midis node-ve n\u00eb nj\u00eb klaster, me vones\u00eb minimale dhe dor\u00ebzim t\u00eb garantuar. Nj\u00eb sulm \u00ebsht\u00eb i mundur n\u00eb sistemet me n\u00ebn sistemin io_uring t\u00eb aktivizuar (io_uring_disabled=0) dhe me b\u00ebrtham\u00ebn e nd\u00ebrtuar me opsionet CONFIG_RDS, CONFIG_RDS_TCP dhe CONFIG_IO_URING. P\u00ebr funksionimin e eksploitatit, n\u00eb sistem duhet t\u00eb ket\u00eb nj\u00eb skedar ekzekutiv t\u00eb aksesuesh\u00ebm p\u00ebr lexim me flag SUID-root. <\/p>\n
P\u00ebr ngarkimin automatik t\u00eb modulit t\u00eb thelbit rds_tcp, eksploiti k\u00ebrkon d\u00ebrgimin e t\u00eb dh\u00ebnave p\u00ebrmes RDS duke p\u00ebrdorur transportin SO_RDS_TRANSPORT=2. V\u00ebrehet se, nga distribucione t\u00eb testuara Linux, moduli i thelbit rds ofrohet vet\u00ebm n\u00eb Arch Linux n\u00eb konfigurimin e tij t\u00eb parazgjedhur. P\u00ebr t\u00eb bllokuar k\u00ebt\u00eb vulnerabilitet, mund t\u00eb bllokoni ngarkimin automatik t\u00eb moduleve t\u00eb thelbit rds dhe rds_tcp: rmmod rds_tcp rds printf 'install rds \/bin\/false\ninstall rds_tcp \/bin\/false\n' > \/etc\/modprobe.d\/pintheft.conf <\/p>\n
Vulnerabiliteti shkaktohet nga nj\u00eb gabim n\u00eb implementimin e mekanizmit zerocopy n\u00eb funksionin rds_message_zcopy_from_user(), i cili b\u00ebn modifikimin e drejtp\u00ebrdrejt\u00eb t\u00eb t\u00eb dh\u00ebnave n\u00eb cache-in e faqeve p\u00ebr t\u00eb shmangur mbivendosjen e panevojshme. N\u00eb rast t\u00eb d\u00ebshtimit, nuk u pastrua fusha rm->data.op_nents, gj\u00eb q\u00eb \u00e7oi n\u00eb \u00e7lirimin e dyfisht\u00eb t\u00eb memorie (double-free). Pjesa e pap\u00ebrshtatshme e numrit t\u00eb referencave u shfryt\u00ebzua p\u00ebr t\u00eb shkruar t\u00eb dh\u00ebna n\u00eb cache-in e faqeve, fal\u00eb manipulimit me treguesin e nj\u00eb buferi t\u00eb fiksuar io_uring. <\/p>\n
N\u00eb t\u00eb tjerat, mekanizmi i eksploatimit \u00ebsht\u00eb tipik p\u00ebr t\u00eb gjitha vulnerabilitetet e k\u00ebtij klasi \u2014 sulmuesi arrin q\u00eb t\u00eb vendos\u00eb nj\u00eb skedar programi me flamurin suid root n\u00eb cache-in e faqeve, pas s\u00eb cil\u00ebs inserton n\u00eb krye t\u00eb ELF kodin p\u00ebr t\u00eb ekzekutuar \/usr\/bin\/sh. Pas k\u00ebsaj manipulimi, ekzekutimi i programit \u00e7on n\u00eb ngarkimin n\u00eb memorie jo t\u00eb skedarit origjinal ekzekutues nga ruajt\u00ebsi, por t\u00eb nj\u00eb kopje t\u00eb ndryshuar nga cache-i i faqeve. Ndryshe nga eksploitat e kaluara, varianti i ri \u00ebsht\u00eb i adaptuar vet\u00ebm p\u00ebr sulmin ndaj utilitarit \"su\", por gjithashtu mund t\u00eb p\u00ebrdoret n\u00eb prani t\u00eb skedar\u00ebve t\u00eb till\u00eb si mount, passwd, chsh, newgrp, umount dhe pkexec. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"