{"id":182332,"date":"2026-06-27T08:48:07","date_gmt":"2026-06-27T06:48:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha"},"modified":"2026-06-27T08:48:07","modified_gmt":"2026-06-27T06:48:07","slug":"pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/pedit-cow-i-dirtyclone-uyazvimosti-v-yadre-linux-pozvolyayushhie-poluchit-root-cherez-izmenenie-stranichnogo-kesha","title":{"rendered":"PEdit-CoW dhe DirtyClone \u2014 vulnerabilitete n\u00eb kernelin Linux q\u00eb lejojn\u00eb marrjen e root-it p\u00ebrmes ndryshimit t\u00eb caches t\u00eb faqeve","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Informacioni p\u00ebr dy vulnerabilitete t\u00eb reja n\u00eb b\u00ebrtham\u00ebn Linux \u00ebsht\u00eb zbuluar, t\u00eb cilat lejojn\u00eb nj\u00eb p\u00ebrdorues pa privilegje t\u00eb fitoj\u00eb t\u00eb drejta root duke rishkruar t\u00eb dh\u00ebnat n\u00eb cache-n\u00eb e faqeve. Ekzistojn\u00eb eksploit\u00eb funksionale p\u00ebr t\u00eb dy vulnerabilitetet.<\/p>\n
\n
PEdit-CoW (CVE-2026-46331, eksploit 1, eksploit 2) \u2014 nj\u00eb gabim n\u00eb zbatimin e mekanizmit t\u00eb kopjimit n\u00eb shkrim n\u00eb kodin e ndryshimit t\u00eb titujve t\u00eb paketave (act_pedit), i p\u00ebrdorur n\u00eb planifikuesin e paketave rrjet (net\/sched), lejon t\u00eb shkruhen t\u00eb dh\u00ebna p\u00ebrtej tamponit t\u00eb alokuar, q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb rishkruar t\u00eb dh\u00ebna n\u00eb cache-n\u00eb e faqeve me nj\u00eb offset t\u00eb zgjedhur. Ky gabim ndodh sepse verifikimi i zon\u00ebs s\u00eb lejueshme p\u00ebr t\u00eb shkruar t\u00eb dh\u00ebna b\u00ebhej pa marr\u00eb parasysh se offset-i p\u00ebr fushat e redaktueshme mund t\u00eb ndryshoj\u00eb gjat\u00eb ekzekutimit t\u00eb operacionit.\n
Problemi fillon nga b\u00ebrthama Linux 5.18 dhe \u00ebsht\u00eb rregulluar n\u00eb versionet 7.1, 7.0.13, 6.18.36 dhe 6.12.94. Ekspozimi i mund\u00ebsis\u00eb s\u00eb shfryt\u00ebzimit t\u00eb problemit \u00ebsht\u00eb deklaruar n\u00eb RHEL 8\/9\/10, Debian 11\/12, openSUSE Leap 15.6, SUSE Linux 15-SP7\/16.0 dhe Ubuntu 18.04-25.10 (n\u00eb versionin Ubuntu 26.4, mund\u00ebsia p\u00ebr t\u00eb krijuar user namespace \u00ebsht\u00eb bllokuar si p\u00ebr default). Si nj\u00eb zgjidhje alternative p\u00ebr mbrojtje, rekomandohet q\u00eb t\u00eb ndalohet ngarkimi i modulit t\u00eb b\u00ebrtham\u00ebs act_pedit (rregullat e kufizimit t\u00eb trafikut dhe rishkrimi i titujve p\u00ebrmes \u00abtc pedit\u00bb do t\u00eb ndalohen).<\/p>\n
DirtyClone (CVE-2026-43503, eksploit) \u2014 nj\u00eb zgjidhje p\u00ebr shfryt\u00ebzimin e vulnerabilitetit Dirty Frag n\u00eb modul xfrm-ESP, i p\u00ebrdorur p\u00ebr t\u00eb p\u00ebrshpejtuar operacionet e enkriptimit n\u00eb IPsec duke p\u00ebrdorur protokollin ESP (Encapsulating Security Payload). P\u00ebr t\u00eb klonuar struktur\u00ebn skb n\u00eb eksploitin e ri, p\u00ebrdoret manipulimi me zgjatimin TEE n\u00eb netfilter (moduli xt_TEE), i cili kryen operacionin e klonimit t\u00eb paketave rrjet.\n
Vulnerabiliteti \u00ebsht\u00eb rregulluar n\u00eb versionet e b\u00ebrtham\u00ebs Linux 7.1, 7.0.10, 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91 dhe 6.18.33. Problemi shfaqet n\u00eb Debian, Ubuntu, Fedora, \nRHEL dhe SUSE. Si nj\u00eb zgjidhje p\u00ebr bllokimin e vulnerabilitetit, mund t\u00eb ndalohet ngarkimi i moduleve t\u00eb b\u00ebrtham\u00ebs esp4 dhe esp6.<\/p>\n<\/ul>\n
P\u00ebr t\u00eb shfryt\u00ebzuar t\u00eb dyja dob\u00ebsit\u00eb k\u00ebrkohen t\u00eb drejtat e qasjeve CAP_NET_ADMIN, t\u00eb cilat nj\u00eb p\u00ebrdorues i paprivilegjuar mund t'i fitoj\u00eb p\u00ebrmes krijimit t\u00eb hap\u00ebsirave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve (user namespace). N\u00eb Ubuntu, nj\u00eb operacion i till\u00eb e ka n\u00eb parazgjedhje t\u00eb ndaluar, por mund t\u00eb lejohet p\u00ebrmes sysctl \"kernel.apparmor_restrict_unprivileged_userns=0\" ose profileve AppArmor. N\u00eb shp\u00ebrndarje t\u00eb tjera, disponueshm\u00ebria e \"user namespace\" p\u00ebr p\u00ebrdoruesit e paprivilegjuar varet nga vendosja e sysctl \"kernel.unprivileged_userns_clone\" (n\u00ebse \u00ebsht\u00eb 0, at\u00ebher\u00eb ndalohet). <\/p>\n
Shfryt\u00ebzimi i dob\u00ebsive p\u00ebrfshin leximin e skedarit t\u00eb programit \/bin\/su me flamurin suid root, p\u00ebr ta ruajtur n\u00eb cache t\u00eb faqeve, dhe z\u00ebvend\u00ebsimin n\u00eb cache t\u00eb faqeve t\u00eb nj\u00eb pjese t\u00eb kodit t\u00eb programit me kodin p\u00ebr t\u00eb ekzekutuar \/bin\/sh. Aktivizimi i m\u00ebvonsh\u00ebm i programit do t\u00eb b\u00ebj\u00eb q\u00eb n\u00eb memorie t\u00eb ngarkohet jo skedari origjinal ekzekutiv nga ruajt\u00ebsi, por nj\u00eb kopje e modifikuar nga cache i faqeve. <\/p>\n
N\u00eb p\u00ebrfundim, mund t\u00eb p\u00ebrmendet krijimi i nj\u00eb eksploit p\u00ebr dob\u00ebsin\u00eb CVE-2026-23111 n\u00eb n\u00ebndeg\u00ebn nf_tables, e cila \u00ebsht\u00eb eliminuar n\u00eb p\u00ebrdit\u00ebsimet e shkurtit t\u00eb b\u00ebrtham\u00ebs Linux. Dob\u00ebsia shkaktohet nga qasja n\u00eb memorie pas \u00e7lirimit t\u00eb saj (use-after-free) dhe mund\u00ebson nj\u00eb p\u00ebrdoruesi t\u00eb paprivilegjuar t\u00eb fitoj\u00eb t\u00eb drejtat root n\u00eb sistem. P\u00ebr t\u00eb sulmuar, p\u00ebrdoruesi gjithashtu duhet t\u00eb ket\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb krijuar hap\u00ebsira t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve (user namespace). Funksionimi i eksploitit \u00ebsht\u00eb demonstruar n\u00eb \nDebian 12\/13 dhe Ubuntu 22.04\/24.04. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"