Ukuphepha kwe-Linux kubhekene nenye inselelo ngemuva kokutholakala kwe- ubungozi CVE-2026-31431, ebizwa ngokuthi "Ukuhluleka Kokukopisha" ngabacwaningi baseXint Code. Kunokuba kube iphutha elingokombono, le nkinga yokuklama Ivumela umsebenzisi wendawo ongenamalungelo okukhulisa izimvume zakhe futhi athole ukufinyelela okugcwele. njengomsebenzisi omkhulu ngendlela ebikezelwayo nethule.
Abacwaningi bathi lobu buthakathaka busetshenziswe ngempumelelo ekusakazweni okuhamba phambili njenge-Ubuntu, i-Amazon Linux, i-RHEL, kanye ne-SUSE, okuqinisekisa ukuthi noma yiluphi uhlelo olusebenzisa i-kernel kamuva kunenguqulo 4.14 kanye Qhubeka Ukunika amandla ukwesekwa kwama-socket e-AF_ALG kungaba sengozini kulokhu kuhlasela.
Ukusebenza Kwangaphakathi kanye Nokugcwala Kwe-Cache Yekhasi
Ngokuphathelene nesinqumo, kukhulunywa ngokuthi lokhu Iqala emuva ekuthuthukisweni okwethulwe ngo-2017 ngaphakathi kwe-kernel's cryptographic API (AF_ALG). Lokhu kuguqulwa Bengifuna ukuqeda ukubhafa okungadingekile. ukwenza imisebenzi yokubethela okuqinisekisiwe (i-AEAD) ngqo endaweni efanayo yememori, eyaziwa ngokuthi imisebenzi "esendaweni".
El Kuvela inkinga ebalulekile lapho kuhlanganiswa lokhu kulungiswa nomsebenzi we-splice(), Le ndlela idlulisela idatha phakathi kwezincazelo zamafayela ngokudlulisela izinkomba eziqondile ku-cache yekhasi le-kernel esikhundleni sokukopisha idatha ngokoqobo. Lapho icela ukuqaqa ukubethela, isakhiwo sememori sahlelwa ngendlela yokuthi i-destination buffer, okufanele ibe yindawo yesikhashana yomsebenzisi, igcine ixhunywe ngqo kumakhasi e-cache aqukethe idatha yefayela lesistimu.
Ukuqinisekiswa nokubhala okungaphezu kwemingcele yememori
El Isisusa sokugcina sobuthakathaka sisekuziphatheni okungavamile kwe-algorithm ye-authencesn. Ngokungafani neminye imikhuba ye-cryptographic ehlonipha ngokuqinile imingcele yezindawo ezigcina idatha, Le algorithm ethile isebenzisa isikhala sememori somsebenzisi njengendawo yokusebenza yesikhashana (scratch pad) ukuze uhlele kabusha ukulandelana kwama-byte ngesikhathi sokubalwa kwethegi yokuqinisekisa.
Kule nqubo, i-algorithm ibhala amabhayithi amane ngaphezu komkhawulo omisiwe wesifunda sokukhipha. Ngenxa yokwenza ngcono endaweni kanye nochungechunge lokubhekisela oludalwe yi-splice(),Lo mbhalo obonakala ungenangozi weqa umngcele wenkumbulo yomsebenzisi bese ifika ngqo ekhasini le-kernel cache elihlobene nefayela elicutshungulwayo.
Lolu chungechunge lokwehluleka okunengqondo Inika umhlaseli ikhono lokubhala ngaphezulu ama-byte amane ngokungenanjongo ezindaweni ezithile ze-cache yamakhasi anoma yiliphi ifayela elingalifunda. Ngokuthumela uchungechunge lwezicelo ezibaliwe, umhlaseli angafaka ikhodi enonya kunguqulo ekwimemori yamafayela abalulekile asebenzisekayo anesethi ye-suid bit, njengethuluzi lokushintsha lomsebenzisi.
Njengoba yonke imisebenzi yokufunda iqala ngokubuza i-cache yekhasi, ngesikhathi esizayo lapho ukusetshenziswa okusemthethweni kubizwa, Uhlelo luzosebenzisa ikhodi efakiwe kusuka kwimemori, lunikeze amalungelo ezimpande ezisheshayo. ngaphandle kokushintsha ifayela elibonakalayo ku-hard drive. Okwethusa nakakhulu, ngoba ukuhlukaniswa kwesitsha kwabelana nge-cache yekhasi lomsingathi oyisisekelo, lokhu kuba sengozini kusebenza njengesango eliqondile lokubalekela izindawo ezi-virtualized njengeqembu le-Kubernetes futhi kubeke engcupheni i-node eyinhloko.
Izixazululo zokunciphisa izimo eziphuthumayo kanye nezimo eziphuthumayo
Njengoba lesi sinqumo sibaluleke kakhulu, Amaqembu okulungisa athumele izibuyekezo eziphuthumayo, lapho ikhambi eliqinisekile likhona Buyisela emuva ukulungiswa kwendawo ngaphakathi kwefayela le-algif_aead.c, uhlukanise ngokuqinile uhlu lwememori yomthombo kanye nendawo oya kuyo ukuvimbela amakhasi agciniwe ukuthi angagcini emigwaqweni ebhalwe phansi.
Lawa ma-patches asevele ehlanganiswe kuma-kernel 6.18.22, 6.19.12, kanye no-7.0, futhi athunyelwa emuva emagatsheni okusekela esikhathi eside. Kubaphathi abangakwazi ukuqala kabusha noma ukuvuselela amaseva abo ngokushesha, kunconywa ukuthi bakhubaze i-algif_aead kernel module uma ihlanganiswe ngaphandle, noma banciphise kakhulu ukudalwa kwama-socket e-AF_ALG kusetshenziswa izinqubomgomo zokuphepha ezifana ne-SELinux, isivikelo, isibonelo, esigcine amadivayisi amanje e-Android ephephile kulolu songo.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe, ungathola imininingwane kusixhumanisi esilandelayo.