{"id":181668,"date":"2026-05-23T00:25:11","date_gmt":"2026-05-22T22:25:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-23T00:25:11","modified_gmt":"2026-05-22T22:25:11","slug":"gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/gro-frag-sedmaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"GRO Frag \u2014 nj\u00eb vulnerabilitet i shtat\u00eb n\u00eb klas\u00ebn e Copy Fail, q\u00eb jep t\u00eb drejta root n\u00eb Linux.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nj\u00eb exploit p\u00ebr dob\u00ebsin\u00eb e shtat\u00eb (1, 2-3, 4, 5, 6) n\u00eb b\u00ebrtham\u00ebn Linux \u00ebsht\u00eb publikuar n\u00eb akses t\u00eb hapur, e cila lejon nj\u00eb p\u00ebrdorues lokal pa privilegje t\u00eb fitoj\u00eb t\u00eb drejtat e root, duke shkruar t\u00eb dh\u00ebnat n\u00eb cache t\u00eb faqes. Identifikuesi CVE akoma nuk \u00ebsht\u00eb caktuar, p\u00ebrve\u00e7 kodit t\u00eb exploit-it nuk ka informacion tjet\u00ebr p\u00ebr problemin. Nj\u00eb rregullim \u00ebsht\u00eb i disponuesh\u00ebm vet\u00ebm si patch, i cili u publikua m\u00eb 20 maj dhe m\u00eb 21 maj u miratua n\u00eb deg\u00ebn kryesore t\u00eb b\u00ebrtham\u00ebs Linux (l\u00ebshimet korrigjuese t\u00eb b\u00ebrtham\u00ebs ende nuk jan\u00eb n\u00eb dispozicion). <\/p>\n
Nj\u00eb vulnerabilitet \u00ebsht\u00eb i pranish\u00ebm n\u00eb implementimin e teknologjis\u00eb GRO (Generic Receive Offload), e cila p\u00ebrdoret p\u00ebr t\u00eb p\u00ebrshpejtuar p\u00ebrpunimin e paketave t\u00eb segmentuara. Vulnerabiliteti shkaktohet nga nj\u00eb gabim n\u00eb implementimin e mekanizmit zerocopy n\u00eb funksionin skb_gro_receive(), i cili kryen ndryshimin direkt t\u00eb t\u00eb dh\u00ebnave n\u00eb cache-n\u00eb e faqeve p\u00ebr t\u00eb shmangur buferizimin e panevojsh\u00ebm. Kur ishte e vendosur flag-u SKBFL_MANAGED_FRAG_REFS, ruajtja e referenc\u00ebs p\u00ebr faqet e memories q\u00eb \u00e7oheshin do t\u00eb kalonte, pas s\u00eb cil\u00ebs ky fush\u00eb do t\u00eb bashk\u00ebngjitej me nj\u00eb skb tjet\u00ebr pa ndryshuar num\u00ebruesin e referencave, gj\u00eb q\u00eb \u00e7onte n\u00eb qasje n\u00eb memory pas \u00e7lirimit t\u00eb saj (use-after-free). Problemi u eksploitua p\u00ebr t\u00eb riparuar t\u00eb dh\u00ebnat n\u00eb cache-n\u00eb e faqeve, fal\u00eb manipulimit me treguesin n\u00eb buferin io_uring. <\/p>\n
Shtylla \u00ebsht\u00eb e mundshme n\u00eb sistemet me n\u00ebn-sistem t\u00eb aktivizuar io_uring (io_uring_disabled=0). P\u00ebr t\u00eb funksionuar eksploituesi, nj\u00eb skedar ekzekutiv me flamurin SUID-root duhet t\u00eb jet\u00eb i aksesuesh\u00ebm p\u00ebr lexim n\u00eb sistem. Mekanizmi i shfryt\u00ebzimit p\u00ebrfshin arritjen e ruajtjes s\u00eb baz\u00ebs s\u00eb p\u00ebrdoruesve n\u00eb caches t\u00eb faqeve, pas s\u00eb cil\u00ebs vihet n\u00eb cache rruga \"hax::0:0::\/root:\/bin\/sh\". M\u00eb pas, ekzekutohet komanda \"su hax\", e cila merr jo origjinalen e baz\u00ebs s\u00eb p\u00ebrdoruesve nga ruajt\u00ebsi, por nj\u00eb kopje t\u00eb ndryshuar me emrin e falsifikuar \"hax\", i cili ka t\u00eb drejtat root dhe nj\u00eb fjal\u00ebkalim t\u00eb zbraz\u00ebt. Funksionimi i eksploituesit \u00ebsht\u00eb testuar n\u00eb Ubuntu 24.04. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"