{"id":181690,"date":"2026-05-23T18:24:43","date_gmt":"2026-05-23T16:24:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux"},"modified":"2026-05-23T18:24:43","modified_gmt":"2026-05-23T16:24:43","slug":"opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","title":{"rendered":"P\u00ebrdit\u00ebsimi i PoC p\u00ebr DirtyDecrypt \u2014 nj\u00eb vulnerabilitet t\u00eb ri LPE n\u00eb b\u00ebrtham\u00ebn Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/p>\n

\u00cbsht\u00eb publikuar nj\u00eb proof-of-concept p\u00ebr nj\u00eb vulnerabilitet DirtyDecrypt<\/strong>, i njohur gjithashtu si DirtyCBC<\/strong>, i cili i lejon nj\u00eb p\u00ebrdoruesi lokal pa privilegje t\u00eb fitonte t\u00eb drejtat root n\u00eb disa sisteme Linux. Problemi ndodhet n\u00eb kodin rxgk<\/strong> n\u00eb n\u00ebn-sistemin RxRPC<\/strong> dhe lidhet me shkrimin n\u00eb page cache p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb verifikimit copy-on-write n\u00eb funksionin rxgk_decrypt_skb(). Publikimi i PoC \u00ebsht\u00eb raportuar m\u00eb 18 Maj 2026 nga BleepingComputer; vet\u00eb PoC \u00ebsht\u00eb vendosur n\u00eb repozitorin e ekipit V12<\/a>.<\/p>\n

<\/noindex><\/noindex><\/p>\n

<\/p>\n

RxRPC \u00ebsht\u00eb nj\u00eb protokoll rrjeti i kernelit Linux<\/a> mbi UDP, q\u00eb ofron transport t\u00eb besuesh\u00ebm p\u00ebr operacione t\u00eb larg\u00ebta. N\u00eb dokumentacionin e kernelit \u00ebsht\u00eb theksuar ve\u00e7an\u00ebrisht q\u00eb AFS<\/strong> \u2014 Andrew File System \u2014 \u00ebsht\u00eb nj\u00eb shembull aplikacioni q\u00eb p\u00ebrdor RxRPC, dhe protokolli vet\u00eb mb\u00ebshtet negociatat p\u00ebr sigurin\u00eb e lidhjes. Pik\u00ebrisht n\u00eb k\u00ebt\u00eb fush\u00eb p\u00ebrfshihet RxGK, i p\u00ebrdorur p\u00ebr modalitetin e siguruar RxRPC\/AFS.<\/p>\n

<\/noindex><\/p>\n

Sipas p\u00ebrshkrimit t\u00eb V12, DirtyDecrypt \u00ebsht\u00eb nj\u00eb variant tjet\u00ebr i vulnerabiliteteve t\u00eb klas\u00ebs CopyFail \/ Dirty Frag \/ Fragnesia<\/strong>. T\u00eb gjitha k\u00ebto p\u00ebrqendrohen rreth ideve t\u00eb ngjashme: trajtimi jo i duhur i memories s\u00eb b\u00ebrtham\u00ebs, cache t\u00eb faqes dhe buffereve mund t\u00eb lejoj\u00eb q\u00eb nj\u00eb proces lokal pa privilegje t\u00eb ndikoj\u00eb n\u00eb t\u00eb dh\u00ebnat q\u00eb duhet t\u00eb jen\u00eb t\u00eb paarritshme p\u00ebr shkrim. N\u00eb rastin e DirtyDecrypt, flitet p\u00ebr \"rxgk pagecache write\" p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb mbrojtjes COW n\u00eb rxgk_decrypt_skb().<\/p>\n

Ekipi V12 pret pr\u00e9tendon se ka zbuluar dhe raportuar problemin 9 Maj 2026<\/strong>, por mb\u00ebshtet\u00ebsit e b\u00ebrtham\u00ebs p\u00ebrgjigj\u00ebn se \u00ebsht\u00eb nj\u00eb kopje e nj\u00eb gabimi q\u00eb \u00ebsht\u00eb rregulluar m\u00eb par\u00eb. Pas k\u00ebsaj, hulumtuesit publikuan PoC, duke e motivuar k\u00ebt\u00eb me faktin se rregullimi tashm\u00eb ndodhet n\u00eb b\u00ebrtham\u00ebn kryesore.<\/p>\n

Me situat\u00ebn e CVE duket se nuk \u00ebsht\u00eb plot\u00ebsisht e qart\u00eb. BleepingComputer raporton se nuk ka nj\u00eb CVE zyrtare p\u00ebr emrin DirtyDecrypt n\u00eb momentin e publikimit, por analisti Will Dormann lidh detajet e publikuara t\u00eb V12 me CVE-2026-31635<\/strong>, q\u00eb \u00ebsht\u00eb rregulluar n\u00eb fund t\u00eb prillit. N\u00eb baz\u00ebn e t\u00eb dh\u00ebnave NVD, CVE-2026-31635 p\u00ebrshkruhet si nj\u00eb gabim n\u00eb rxrpc: funksioni rxgk_verify_response() nuk verifikonte si duhet gjat\u00eb e autentifikuesit RESPONSE, duke b\u00ebr\u00eb q\u00eb nj\u00eb autentifikues tep\u00ebr i madh t\u00eb hyj\u00eb n\u00eb rxgk_decrypt_skb() dhe t\u00eb \u00e7onte kodin n\u00eb BUG_ON(len).<\/p>\n

<\/p>\n

Pra, publikimet publike lidhin DirtyDecrypt me CVE-2026-31635<\/a><\/strong>, por\u00eb formalja e p\u00ebrshkrimit t\u00eb CVE n\u00eb NVD duket ende m\u00eb e ngusht\u00eb dhe flet kryesisht p\u00ebr nj\u00eb gabim n\u00eb verifikimin e gjat\u00ebsi n\u00eb rxrpc, dhe jo drejtp\u00ebrdrejt p\u00ebr alias DirtyDecrypt\/DirtyCBC si nj\u00eb regjistrim t\u00eb ve\u00e7ant\u00eb. Prandaj, \u00ebsht\u00eb m\u00eb korrekte t\u00eb shkruhet: DirtyDecrypt, me siguri, korrespondon ose \u00ebsht\u00eb ngusht\u00eb i lidhur me CVE-2026-31635<\/em>, dhe jo t\u00eb thuhet se kjo \u00ebsht\u00eb emri zyrtar i CVE.<\/p>\n

<\/noindex><\/p>\n

P\u00ebr shfryt\u00ebzim k\u00ebrkohet nj\u00eb b\u00ebrtham\u00eb me opsionin e aktivizuar CONFIG_RXGK<\/strong>, i cili p\u00ebrfshin mb\u00ebshtetje p\u00ebr RxGK p\u00ebr klientin AFS dhe transportin rrjet. Kjo e ngushton duksh\u00ebm grupin e sistemeve t\u00eb prekura: n\u00eb radh\u00eb t\u00eb par\u00eb flasim p\u00ebr shp\u00ebrndarjet q\u00eb ndjekin shpejt b\u00ebrtham\u00ebn upstream, duke p\u00ebrfshir\u00eb Fedora<\/strong>, Arch Linux<\/strong> dhe openSUSE Tumbleweed<\/strong>. N\u00eb k\u00ebt\u00eb rast, BleepingComputer thekson se V12 PoC i publikuar \u00ebsht\u00eb testuar vet\u00ebm n\u00eb Fedora dhe b\u00ebrtham\u00ebn kryesore.<\/p>\n

<\/p>\n

DirtyDecrypt u shfaq n\u00eb sfondin e nj\u00eb s\u00ebr\u00eb t\u00eb af\u00ebrt t\u00eb dob\u00ebsive LPE n\u00eb Linux. M\u00eb par\u00eb u zbuluan Copy Fail<\/strong> n\u00eb algif_aead, Dirty Frag<\/strong> n\u00eb komponent\u00ebt rrjet, dhe m\u00eb pas Fragnesia<\/strong> n\u00eb XFRM ESP-in-TCP. Microsoft e p\u00ebrshkroi<\/a> Dirty Frag si nj\u00eb rritje lokale t\u00eb privilegjeve p\u00ebrmes komponent\u00ebve esp4, esp6 dhe rxrpc, duke i mund\u00ebsuar sulmuesit, pasi t\u00eb fitoj\u00eb qasje lokale, t\u00eb ngjitet deri n\u00eb root dhe t\u00eb konsolidohet n\u00eb sistem.<\/p>\n

<\/noindex><\/p>\n

Rreziku praktik t\u00eb till\u00eb gabimesh \u00ebsht\u00eb se ato shpesh p\u00ebrdoren pas nj\u00eb haku fillestar: p\u00ebr shembull, pas kompromiseve t\u00eb llogarive SSH, web shell, konteiner\u00ebve t\u00eb ndjesh\u00ebm ose p\u00ebrdoruesve t\u00eb sh\u00ebrbimit me privilegje t\u00eb ul\u00ebta. Pasi t\u00eb fitoj\u00eb akses root, agresori mund t\u00eb \u00e7aktivizoj\u00eb masat mbrojt\u00ebse, t\u00eb lexoj\u00eb sekrete, t\u00eb ndryshoj\u00eb regjistrat, t\u00eb vendos\u00eb persistenc\u00ebn dhe t\u00eb ec\u00eb m\u00eb tej n\u00eb infrastruktur\u00eb.<\/p>\n

P\u00ebrdoruesit e distribucioneve rolling-release q\u00eb mund t\u00eb preken rekomandohen t\u00eb instalojn\u00eb p\u00ebrdit\u00ebsimet m\u00eb t\u00eb fundit t\u00eb b\u00ebrtham\u00ebs. P\u00ebr sistemet ku p\u00ebrdit\u00ebsimi i menj\u00ebhersh\u00ebm nuk \u00ebsht\u00eb i mundur, publikimet p\u00ebrmendin masa t\u00eb p\u00ebrkohshme si \u00e7aktivizimi i moduleve rxrpc t\u00eb pa p\u00ebrdorura dhe komponenteve t\u00eb lidhura, megjithat\u00eb k\u00ebto zgjidhje an\u00ebsore mund t\u00eb prishin AFS dhe disa skenar\u00eb IPsec\/VPN, prandaj duhet t\u00eb zbatohen vet\u00ebm pas verifikimit t\u00eb ndikimit n\u00eb sistemin specifik.<\/p>\n

P\u00ebr shumic\u00ebn e instalimeve desktop dhe server, rreziku ndoshta \u00ebsht\u00eb m\u00eb i ul\u00ebt se Copy Fail: DirtyDecrypt k\u00ebrkon nj\u00eb konfigurim specifik t\u00eb b\u00ebrtham\u00ebs dhe ekzekutimin lokal t\u00eb kodit. Sidoqoft\u00eb, p\u00ebr Fedora, Arch Linux, openSUSE Tumbleweed dhe sisteme t\u00eb tjera me p\u00ebrdit\u00ebsim t\u00eb shpejt\u00eb t\u00eb b\u00ebrtham\u00ebs, problemi meriton v\u00ebmendje: nuk \u00ebsht\u00eb m\u00eb nj\u00eb raport teorik, por nj\u00eb vulnerabilitet me nj\u00eb PoC t\u00eb botuar dhe nj\u00eb rrug\u00eb t\u00eb qart\u00eb p\u00ebr rritjen e privilegjeve.<\/p>\n

Burimi: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043a\u043e\u0434\u0435 rxgk \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b RxRPC \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0432 page cache \u0438\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 copy-on-write \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 rxgk_decrypt_skb(). \u041e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 PoC 18 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u043e \u0438\u0437\u0434\u0430\u043d\u0438\u0435 BleepingComputer; \u0441\u0430\u043c PoC \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181690","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PoC p\u00ebr DirtyDecrypt \u2013 nj\u00eb vulnerabilitet i ri LPE n\u00eb b\u00ebrtham\u00ebn Linux | ProHoster","description":"\u00cbsht\u00eb publikuar nj\u00eb proof-of-concept p\u00ebr vulnerabilitetin DirtyDecrypt, i njohur gjithashtu si DirtyCBC, q\u00eb lejon nj\u00eb p\u00ebrdorues lokal pa privilegji t\u00eb fitoj\u00eb t\u00eb drejtat root n\u00eb disa sisteme Linux. Problemi ndodhet n\u00eb kodin e n\u00ebn-sistemit RxRPC dhe \u00ebsht\u00eb i lidhur me shkrimin n\u00eb cache t\u00eb faqes p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb kontrollit copy-on-write n\u00eb funksionin rxgk_decrypt_skb(). Publikimi i PoC u njoftua m\u00eb 18 maj 2026 nga BleepingComputer; vet\u00eb PoC \u00ebsht\u00eb publikuar n\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d PoC \u0434\u043b\u044f DirtyDecrypt \u2014 \u043d\u043e\u0432\u043e\u0439 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d proof-of-concept \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 DirtyDecrypt, \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u043a\u0430\u043a DirtyCBC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043a\u043e\u0434\u0435 rxgk \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b RxRPC \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0432 page cache \u0438\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 copy-on-write \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 rxgk_decrypt_skb(). \u041e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 PoC 18 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u043e \u0438\u0437\u0434\u0430\u043d\u0438\u0435 BleepingComputer; \u0441\u0430\u043c PoC \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0432","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/opublikovan-poc-dlya-dirtydecrypt-novoj-lpe-uyazvimosti-v-yadre-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-23T16:24:43+00:00","article:modified_time":"2026-05-23T16:24:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/181690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=181690"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/181690\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=181690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=181690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=181690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}