{"id":172753,"date":"2026-05-19T18:24:36","date_gmt":"2026-05-19T16:24:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux"},"modified":"2026-05-19T18:24:36","modified_gmt":"2026-05-19T16:24:36","slug":"pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","title":{"rendered":"PinTheft \u2014 den sj\u00e4tte s\u00e5rbarheten i Copy Fail-klassen, som ger rootbeh\u00f6righet i Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Information has been revealed about the sixth vulnerability (1, 2-3, 4, 5), which allows an unprivileged local user to gain root rights by rewriting data in the page cache. The vulnerability is codenamed PinTheft. A prototype exploit is available. A CVE identifier has not yet been assigned. A fix is currently available only as a patch, which was published on May 5 and accepted into the netdev branch on May 11 but has not been included in corrective kernel releases. <\/p>\n

The vulnerability exists in the implementation of the RDS (Reliable Datagram Sockets) network protocol, designed for high-speed message exchange between nodes in a cluster, with minimal latency and guaranteed delivery. An attack is possible on systems with the io_uring subsystem enabled (io_uring_disabled=0) and a kernel built with the CONFIG_RDS, CONFIG_RDS_TCP, and CONFIG_IO_URING options. To function, the exploit requires an executable file that is readable and has the SUID-root flag. <\/p>\n

F\u00f6r automatisk inladdning av k\u00e4rnmodulen rds_tcp beg\u00e4r exploiteren att data skickas via RDS med transport SO_RDS_TRANSPORT=2. Det noteras att bland de testade Linux-distributionerna \u00e4r k\u00e4rnmodulen rds endast tillg\u00e4nglig i Arch Linux i standardkonfigurationen. F\u00f6r att blockera s\u00e5rbarheten kan automatisk inladdning av k\u00e4rnmoduler rds och rds_tcp blockeras: rmmod rds_tcp rds printf 'install rds \/bin\/false\ninstall rds_tcp \/bin\/false\n' > \/etc\/modprobe.d\/pintheft.conf <\/p>\n

S\u00e5rbarheten orsakas av ett fel i implementationen av zerocopy-mekanismen i funktionen rds_message_zcopy_from_user(), som direkt \u00e4ndrar data i sidcache f\u00f6r att undvika on\u00f6dig buffring. Vid ett fel rensades inte f\u00e4ltet rm->data.op_nents, vilket resulterade i en dubbel frig\u00f6ring av bufferten (double-free). Framtr\u00e4dandet av ett felaktigt v\u00e4rde i referensr\u00e4knaren kunde utnyttjas f\u00f6r att skriva \u00f6ver data i sidcache genom manipulering av pekaren till en fast buffert io_uring. <\/p>\n

I \u00f6vrigt \u00e4r utnyttjandemekanismen typisk f\u00f6r alla s\u00e5rbarheter av denna typ \u2014 angriparen f\u00e5r en programfil med suid root-flaggan att stanna i sidcache, varefter kod f\u00f6r att starta \/usr\/bin\/sh s\u00e4tts in i ELF-huvudet. Efter denna manipulation leder k\u00f6rningen av programmet till att den \u00e4ndrade kopian fr\u00e5n sidcache laddas i minnet ist\u00e4llet f\u00f6r den ursprungliga exekverbara filen fr\u00e5n lagringsmediet. Till skillnad fr\u00e5n tidigare exploiter \u00e4r den nya varianten anpassad endast f\u00f6r att attackera verktyget \"su\", men kan ocks\u00e5 till\u00e4mpas om systemet har s\u00e5dana suid-program som mount, passwd, chsh, newgrp, umount och pkexec.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0448\u0435\u0441\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (1, 2-3, 4, 5), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f PinTheft. \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u0435\u0449\u0451 \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d 5 \u043c\u0430\u044f \u0438 11 \u043c\u0430\u044f \u0431\u044b\u043b \u043f\u0440\u0438\u043d\u044f\u0442\u0432 \u0432\u0435\u0442\u043a\u0443 netdev, \u043d\u043e \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-172753","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PinTheft \u2014 den sj\u00e4tte s\u00e5rbarheten i klassen Copy Fail, som ger root-r\u00e4ttigheter i Linux | ProHoster","description":"Information om den sj\u00e4tte s\u00e5rbarheten (1, 2-3, 4, 5) har avsl\u00f6jats, vilket till\u00e5ter en icke-priviligierad lokal anv\u00e4ndare att f\u00e5 root-r\u00e4ttigheter genom att skriva \u00f6ver data i sidcacheminnet.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47PinTheft \u2014 \u0448\u0435\u0441\u0442\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u0430 Copy Fail, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0430\u0432\u0430 root \u0432 Linux | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0448\u0435\u0441\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (1, 2-3, 4, 5), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u043e\u043c \u043a\u044d\u0448\u0435.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/pintheft-shestaya-uyazvimost-klassa-copy-fail-predostavlyayushhaya-prava-root-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-19T16:24:36+00:00","article:modified_time":"2026-05-19T16:24:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/172753","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=172753"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/172753\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=172753"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=172753"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=172753"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}