{"id":38990,"date":"2026-05-09T14:28:29","date_gmt":"2026-05-09T06:28:29","guid":{"rendered":"https:\/\/www.deepin.org\/?p=38990"},"modified":"2026-05-09T18:12:45","modified_gmt":"2026-05-09T10:12:45","slug":"linux-kernel-dirty-frag-vulnerability-fix","status":"publish","type":"post","link":"https:\/\/www.deepin.org\/zh\/linux-kernel-dirty-frag-vulnerability-fix\/","title":{"rendered":"\u7d27\u6025\u5b89\u5168\u66f4\u65b0 | Linux Kernel Dirty Frag \u672c\u5730\u63d0\u6743\u6f0f\u6d1e\u4fee\u590d\uff0c\u8bf7\u5c3d\u5feb\u5347\u7ea7\uff01"},"content":{"rendered":"\"\"<\/p>\n

\ud83d\udd14\u00a0\u4eb2\u7231\u7684 deepin \u7528\u6237\u4e0e\u793e\u533a\u4f19\u4f34\u4eec\uff1a<\/span><\/p>\n

\u8fd1\u671f\uff0cLinux Kernel \u88ab\u62ab\u9732\u5b58\u5728\u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u4e1a\u754c\u79f0\u4e3a Dirty Frag \u6216 Copy Fail 2\u3002\u8be5\u6f0f\u6d1e\u5c5e\u4e8e Copy Fail \u6f0f\u6d1e\u540c\u7c7b\u53d8\u79cd\uff0c\u653b\u51fb\u8005\u5728\u5df2\u83b7\u5f97\u672c\u5730\u4f4e\u6743\u9650\u6267\u2f8f\u6761\u4ef6\u7684\u60c5\u51b5\u4e0b\uff0c\u53ef\u80fd\u5229\u2f64\u8be5\u6f0f\u6d1e\u7be1\u6539\u53ea\u8bfb\u2f42\u4ef6\u7684 page cache\uff0c\u8fdb\u2f00\u6b65\u63d0\u5347\u6743\u9650\u5e76\u83b7\u53d6 root \u6743\u9650\u3002<\/span><\/p>\n

\u2f6c\u524d\u516c\u5f00\u8d44\u6599\u663e\u2f70\uff0c\u8be5\u6f0f\u6d1e\u5229\u2f64\u4ee3\u7801\u5df2\u516c\u5f00\u4f20\u64ad\u3002\u9274\u4e8e\u5176\u4e25\u91cd\u6027\u548c\u5e7f\u6cdb\u5f71\u54cd\uff0c\u4e3a\u786e\u4fdd\u60a8\u7684\u7cfb\u7edf\u5b89\u5168\uff0c\u6211\u4eec\u5f3a\u70c8\u5efa\u8bae\u6240\u6709\u7528\u6237\u5c3d\u5feb\u5347\u7ea7\u3002<\/span><\/p>\n

 <\/p>\n

\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

01 \u6f0f\u6d1e\u4fe1\u606f<\/strong><\/h1>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

\u6f0f\u6d1e\u7f16\u53f7\uff1a<\/strong>CVE-2026-43284\u3001CVE-2026-43500<\/p>\n

\u6f0f\u6d1e\u63cf\u8ff0\uff1a<\/strong><\/p>\n

\u8be5\u6f0f\u6d1e\u6d89\u53ca Linux \u5185\u6838\u2f79\u7edc\u534f\u8bae\u6808\u4e2d\u7684 xfrm-ESP \u548c RxRPC \u76f8\u5173\u5904\u7406\u8def\u5f84\u3002\u6f0f\u6d1e\u6e90\u4e8e\u96f6\u62f7\u2ec9\u53d1\u9001\u8def\u5f84\u4e2d\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7 splice() \u5c06\u53ea\u8bfb\u2f42\u4ef6\u7684 page cache \u2eda\u5f15\u2f0a sk_buff \u7684 frag \u533a\u57df\uff1b\u63a5\u6536\u4fa7\u5185\u6838\u4ee3\u7801\u5728\u7279\u5b9a\u6761\u4ef6\u4e0b\u672a\u5bf9\u5916\u90e8\u5171\u4eab frag \u505a\u6709\u6548\u9694\u79bb\u6216\u590d\u5236\uff0c\u968f\u540e\u6267\u2f8f\u539f\u5730\u52a0\u89e3\u5bc6\u64cd\u4f5c\uff0c\u5bfc\u81f4 page cache \u4e2d\u7684\u6570\u636e\u88ab\u5199\u2f0a\u4fee\u6539\u3002\u8be5\u95ee\u9898\u4e0e Dirty Pipe\u3001Copy Fail \u5c5e\u4e8e\u540c\u2f00\u7c7b page cache \u5199\u2f0a\u2edb\u9669\uff0c\u4f46\u5f71\u54cd\u2f0a\u2f1d\u4e0d\u518d\u662falgif_aead\uff0c\u2f7d\u662f sk_buff frag \u76f8\u5173\u8def\u5f84\u3002<\/p>\n

\u6f0f\u6d1e\u7b49\u7ea7\uff1a<\/strong>\u9ad8\u5371<\/p>\n

\u5229\u7528\u6761\u4ef6\uff1a<\/strong><\/p>\n

\u8be5\u6f0f\u6d1e\u94fe\u4e3b\u8981\u5305\u542b\u4e24\u4e2a\u89e6\u53d1\u2f45\u5411\uff1a<\/p>\n

1. xfrm-ESP Page-Cache Write\uff1aESP \u8f93\u2f0a\u8def\u5f84\u5728\u5904\u7406\u7279\u5b9a\u2fae\u7ebf\u6027 skb \u65f6\uff0c\u53ef\u80fd\u7ed5\u8fc7 skb_cow_data()\u590d\u5236\u9694\u79bb\u6d41\u7a0b\uff0c\u76f4\u63a5\u5728 skb frag \u4e0a\u6267\u2f8f\u539f\u5730 AEAD \u89e3\u5bc6\u64cd\u4f5c\u3002\u653b\u51fb\u8005\u53ef\u5728\u6ee1\u2f9c\u672c\u5730\u89e6\u53d1\u6761\u4ef6\u540e\uff0c\u5bf9 page cache \u9020\u6210\u53d7\u63a7\u5199\u2f0a\u3002<\/p>\n

2. RxRPC Page-Cache Write\uff1aRxRPC \u7684 RXKAD \u5b89\u5168\u6821\u9a8c\u8def\u5f84\u4f1a\u5bf9 skb payload \u6267\u2f8f\u539f\u5730\u89e3\u5bc6\u64cd\u4f5c\u3002\u5728\u672a\u4fee\u590d\u5185\u6838\u4e2d\uff0c\u82e5 skb frag \u6307\u5411\u53ea\u8bfb\u2f42\u4ef6 page cache \u2eda\uff0c\u89e3\u5bc6\u5199\u2f0a\u4f1a\u843d\u5230 page cache\u4e0a\uff0c\u9020\u6210\u53ea\u8bfb\u2f42\u4ef6\u5185\u5b58\u6620\u50cf\u88ab\u4fee\u6539\u3002<\/p>\n

\u8be5\u95ee\u9898\u7684\u5b89\u5168\u5f71\u54cd\u4e0d\u4f9d\u8d56\u8fdc\u7a0b\u2f79\u7edc\u66b4\u9732\u3002\u653b\u51fb\u8005\u9700\u8981\u5148\u5177\u5907\u672c\u5730\u4f4e\u6743\u9650\u4ee3\u7801\u6267\u2f8f\u6761\u4ef6\uff0c\u4f8b\u5982\u666e\u901a\u2f64\u2f3eshell\u3001\u88ab\u653b\u9677\u670d\u52a1\u8fdb\u7a0b\u3001\u5bb9\u5668\u5185\u8fdb\u7a0b\u6216\u5176\u4ed6\u53d7\u9650\u6267\u2f8f\u73af\u5883\u3002\u2f00\u65e6\u89e6\u53d1\u6210\u529f\uff0c\u53ef\u80fd\u8fdb\u2f00\u6b65\u83b7\u5f97\u5bbf\u4e3b\u673a root\u6743\u9650\u3002<\/p>\n

\u5f71\u54cd\u8303\u56f4\uff1a<\/strong><\/p>\n

\u6240\u6709\u672a\u66f4\u65b0 deepin 25 \u7684\u7528\u6237\u5747\u53d7\u5f71\u54cd\uff0c\u5efa\u8bae\u7acb\u5373\u66f4\u65b0\u5347\u7ea7\u3002<\/strong><\/p>\n

 <\/p>\n

\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

02 \u4fee\u590d\u8fdb\u5c55<\/strong><\/h1>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

deepin 25\uff086.6 \u53ca 6.18 \u5185\u6838\uff09\uff1a\u5747\u5df2\u63a8\u9001\u4fee\u590d\u66f4\u65b0\uff0c\u8bf7\u5c3d\u5feb\u5347\u7ea7\uff01<\/strong><\/p>\n

 <\/p>\n

deepin \u4f5c\u4e3a\u5728\u00a0DistroWatch \u5168\u7403\u6392\u540d\u4e2d\u8868\u73b0\u4eae\u773c\u3001\u5e7f\u53d7\u5168\u7403\u7528\u6237\u8ba4\u53ef\u7684\u5f00\u6e90\u64cd\u4f5c\u7cfb\u7edf<\/a>\uff0c<\/strong>\u6301\u7eed\u8fed\u4ee3\u6f0f\u6d1e\u54cd\u5e94\uff0c\u5168\u529b\u6253\u9020\u7a33\u5b9a\u53ef\u4fe1\u3001\u5b89\u5168\u65e0\u5fe7\u7684\u5f00\u6e90\u684c\u9762\u751f\u6001\u00a0\u3002<\/p>\n

\u5982\u60a8\u5728\u66f4\u65b0\u548c\u4f7f\u7528\u8fc7\u7a0b\u4e2d\u9047\u5230\u4efb\u4f55\u95ee\u9898\uff0c\u6b22\u8fce\u524d\u5f80deepin\u8bba\u575b\u4e13\u5e16<\/a>\u53cd\u9988\u8ba8\u8bba\uff01","protected":false},"excerpt":{"rendered":"

\ud83d\udd14\u00a0\u4eb2\u7231\u7684 deepin \u7528\u6237\u4e0e\u793e\u533a\u4f19\u4f34\u4eec\uff1a \u8fd1\u671f\uff0cLinux Kernel \u88ab\u62ab\u9732\u5b58\u5728\u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u4e1a\u754c\u79f0\u4e3a Dirty Frag \u6216 Copy Fail 2\u3002\u8be5\u6f0f\u6d1e\u5c5e\u4e8e Copy Fail \u6f0f\u6d1e\u540c\u7c7b\u53d8\u79cd\uff0c\u653b\u51fb\u8005\u5728\u5df2\u83b7\u5f97\u672c\u5730\u4f4e\u6743\u9650\u6267\u2f8f\u6761\u4ef6\u7684\u60c5\u51b5\u4e0b\uff0c\u53ef\u80fd\u5229\u2f64\u8be5\u6f0f\u6d1e\u7be1\u6539\u53ea\u8bfb\u2f42\u4ef6\u7684 page cache\uff0c\u8fdb\u2f00\u6b65\u63d0\u5347\u6743\u9650\u5e76\u83b7\u53d6 root \u6743\u9650\u3002 \u2f6c\u524d\u516c\u5f00\u8d44\u6599\u663e\u2f70\uff0c\u8be5\u6f0f\u6d1e\u5229\u2f64\u4ee3\u7801\u5df2\u516c\u5f00\u4f20\u64ad\u3002\u9274\u4e8e\u5176\u4e25\u91cd ...\u9605\u8bfb\u66f4\u591a<\/a><\/p>\n","protected":false},"author":18825,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[93],"tags":[],"_links":{"self":[{"href":"https:\/\/www.deepin.org\/zh\/wp-json\/wp\/v2\/posts\/38990"}],"collection":[{"href":"https:\/\/www.deepin.org\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.deepin.org\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.deepin.org\/zh\/wp-json\/wp\/v2\/users\/18825"}],"replies":[{"embeddable":true,"href":"https:\/\/www.deepin.org\/zh\/wp-json\/wp\/v2\/comments?post=38990"}],"version-history":[{"count":6,"href":"https:\/\/www.deepin.org\/zh\/wp-json\/wp\/v2\/posts\/38990\/revisions"}],"predecessor-version":[{"id":38999,"href":"https:\/\/www.deepin.org\/zh\/wp-json\/wp\/v2\/posts\/38990\/revisions\/38999"}],"wp:attachment":[{"href":"https:\/\/www.deepin.org\/zh\/wp-json\/wp\/v2\/media?parent=38990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.deepin.org\/zh\/wp-json\/wp\/v2\/categories?post=38990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.deepin.org\/zh\/wp-json\/wp\/v2\/tags?post=38990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}