{"id":47809,"date":"2026-05-03T22:59:19","date_gmt":"2026-05-03T15:59:19","guid":{"rendered":"https:\/\/antoanthongtinhaiphong.gov.vn\/?p=47809"},"modified":"2026-05-05T22:59:51","modified_gmt":"2026-05-05T15:59:51","slug":"lo-hong-copy-fail-trong-linux-ton-tai-gan-mot-thap-ky-4-byte-cung-du-chiem-quyen-root","status":"publish","type":"post","link":"https:\/\/antoanthongtinhaiphong.gov.vn\/lo-hong-copy-fail-trong-linux-ton-tai-gan-mot-thap-ky-4-byte-cung-du-chiem-quyen-root\/","title":{"rendered":"L\u1ed7 h\u1ed5ng Copy Fail trong Linux t\u1ed3n t\u1ea1i g\u1ea7n m\u1ed9t th\u1eadp k\u1ef7: 4 byte c\u0169ng \u0111\u1ee7 chi\u1ebfm quy\u1ec1n root"},"content":{"rendered":"
M\u1ed9t l\u1ed7 h\u1ed5ng leo thang \u0111\u1eb7c quy\u1ec1n nghi\u00eam tr\u1ecdng v\u1eeba \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 trong nh\u00e2n Linux \u0111ang khi\u1ebfn c\u1ed9ng \u0111\u1ed3ng an ninh m\u1ea1ng hoang mang, kh\u00f4ng ph\u1ea3i v\u00ec n\u00f3 \u201cm\u1edbi toanh\u201d m\u00e0 v\u00ec n\u00f3 \u00e2m th\u1ea7m t\u1ed3n t\u1ea1i g\u1ea7n m\u1ed9t th\u1eadp k\u1ef7 trong l\u00f5i h\u1ec7 \u0111i\u1ec1u h\u00e0nh m\u00e0 h\u00e0ng t\u1ef7 thi\u1ebft b\u1ecb \u0111ang s\u1eed d\u1ee5ng. V\u1edbi m\u1ed9t \u0111o\u1ea1n m\u00e3 khai th\u00e1c ch\u1ec9 v\u00e0i tr\u0103m byte, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 bi\u1ebfn m\u1ed9t t\u00e0i kho\u1ea3n ng\u01b0\u1eddi d\u00f9ng b\u00ecnh th\u01b0\u1eddng th\u00e0nh quy\u1ec1n qu\u1ea3n tr\u1ecb cao nh\u1ea5t, m\u1edf ra c\u00e1nh c\u1eeda ki\u1ec3m so\u00e1t to\u00e0n b\u1ed9 h\u1ec7 th\u1ed1ng.<\/b>
\n\u200b<\/div>\n
\n
\"root.jpg\"<\/div>\n<\/div>\n
B\u1ee9c tranh t\u1ed5ng th\u1ec3: L\u1ed7 h\u1ed5ng l\u00e0 g\u00ec, xu\u1ea5t hi\u1ec7n \u1edf \u0111\u00e2u?\u200b<\/div>\n
L\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c \u0111\u1ecbnh danh l\u00e0 CVE-2026-31431, c\u00f3 \u0111i\u1ec3m CVSS 7,8 (m\u1ee9c cao), \u0111\u01b0\u1ee3c c\u00e1c nh\u00f3m nghi\u00ean c\u1ee9u t\u1eeb Xint.io v\u00e0 Theori ph\u00e1t hi\u1ec7n v\u00e0 \u0111\u1eb7t t\u00ean l\u00e0 \u201cCopy Fail\u201d. \u0110\u00e2y l\u00e0 m\u1ed9t l\u1ed7i leo thang \u0111\u1eb7c quy\u1ec1n c\u1ee5c b\u1ed9 (Local Privilege Escalation – LPE) trong nh\u00e2n Linux, \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn h\u1ea7u h\u1ebft c\u00e1c b\u1ea3n ph\u00e2n ph\u1ed1i ph\u1ed5 bi\u1ebfn nh\u01b0 Ubuntu, Red Hat Enterprise Linux, SUSE hay Amazon Linux.<\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd l\u00e0 l\u1ed7 h\u1ed5ng n\u00e0y kh\u00f4ng ph\u1ea3i m\u1edbi xu\u1ea5t hi\u1ec7n g\u1ea7n \u0111\u00e2y. N\u00f3 b\u1eaft ngu\u1ed3n t\u1eeb m\u1ed9t thay \u0111\u1ed5i trong m\u00e3 ngu\u1ed3n kernel \u0111\u01b0\u1ee3c \u0111\u01b0a v\u00e0o t\u1eeb th\u00e1ng 8\/2017, n\u1eb1m trong th\u00e0nh ph\u1ea7n x\u1eed l\u00fd m\u1eadt m\u00e3 c\u1ee7a h\u1ec7 th\u1ed1ng, c\u1ee5 th\u1ec3 l\u00e0 module\u00a0algif_aead<\/b>. T\u1eeb \u0111\u00f3 \u0111\u1ebfn nay, l\u1ed7i t\u1ed3n t\u1ea1i \u00e2m th\u1ea7m m\u00e0 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n, len l\u1ecfi trong g\u1ea7n nh\u01b0 to\u00e0n b\u1ed9 h\u1ec7 sinh th\u00e1i Linux hi\u1ec7n \u0111\u1ea1i.\u200b<\/div>\n

Nguy\u00ean nh\u00e2n c\u1ed1t l\u00f5i: M\u1ed9t \u201cl\u1ed7i logic\u201d nh\u1ecf, h\u1eadu qu\u1ea3 l\u1edbn\u200b<\/div>\n
V\u1ec1 b\u1ea3n ch\u1ea5t, \u0111\u00e2y kh\u00f4ng ph\u1ea3i l\u1ed7i tr\u00e0n b\u1ed9 nh\u1edb hay l\u1ed7i race condition th\u01b0\u1eddng th\u1ea5y, m\u00e0 l\u00e0 m\u1ed9t l\u1ed7i logic trong c\u00e1ch kernel x\u1eed l\u00fd d\u1eef li\u1ec7u m\u00e3 h\u00f3a. C\u1ee5 th\u1ec3, m\u1ed9t t\u1ed1i \u01b0u h\u00f3a trong module algif_aead \u0111\u00e3 v\u00f4 t\u00ecnh cho ph\u00e9p m\u1ed9t v\u00f9ng b\u1ed9 nh\u1edb thu\u1ed9c\u00a0page cache<\/b>\u00a0(b\u1ed9 nh\u1edb \u0111\u1ec7m c\u1ee7a file h\u1ec7 th\u1ed1ng) b\u1ecb s\u1eed d\u1ee5ng sai m\u1ee5c \u0111\u00edch.<\/p>\n

H\u1ec7 qu\u1ea3 l\u00e0 m\u1ed9t ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng c\u00f3 quy\u1ec1n cao v\u1eabn c\u00f3 th\u1ec3 ghi m\u1ed9t l\u01b0\u1ee3ng nh\u1ecf d\u1eef li\u1ec7u (4 byte m\u1ed7i l\u1ea7n) v\u00e0o n\u1ed9i dung c\u1ee7a c\u00e1c file m\u00e0 h\u1ecd ch\u1ec9 c\u00f3 quy\u1ec1n \u0111\u1ecdc, bao g\u1ed3m c\u1ea3 c\u00e1c file h\u1ec7 th\u1ed1ng nh\u1ea1y c\u1ea3m.<\/p>\n

Nghe c\u00f3 v\u1ebb \u201c\u00edt \u1ecfi\u201d, nh\u01b0ng trong th\u1ebf gi\u1edbi b\u1ea3o m\u1eadt, 4 byte \u0111\u00fang ch\u1ed7 c\u00f3 th\u1ec3 l\u00e0 \u0111\u1ee7 \u0111\u1ec3 ph\u00e1 v\u1ee1 to\u00e0n b\u1ed9 h\u1ec7 th\u1ed1ng.\u200b<\/p><\/div>\n

C\u00e1ch th\u1ee9c khai th\u00e1c: T\u1eeb ng\u01b0\u1eddi th\u01b0\u1eddng l\u00ean root ch\u1ec9 trong v\u00e0i b\u01b0\u1edbc\u200b<\/div>\n
K\u1ecbch b\u1ea3n khai th\u00e1c l\u1ed7 h\u1ed5ng n\u00e0y \u0111\u01b0\u1ee3c c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u m\u00f4 t\u1ea3 l\u00e0 c\u1ef1c k\u1ef3 \u0111\u01a1n gi\u1ea3n v\u00e0 \u0111\u00e1ng lo ng\u1ea1i. M\u1ed9t \u0111o\u1ea1n script Python kho\u1ea3ng 700 byte l\u00e0 \u0111\u1ee7 \u0111\u1ec3 th\u1ef1c hi\u1ec7n to\u00e0n b\u1ed9 qu\u00e1 tr\u00ecnh.<\/p>\n

\u0110\u1ea7u ti\u00ean, k\u1ebb t\u1ea5n c\u00f4ng m\u1edf m\u1ed9t socket \u0111\u1eb7c bi\u1ec7t c\u1ee7a Linux (AF_ALG) v\u00e0 li\u00ean k\u1ebft n\u00f3 v\u1edbi c\u01a1 ch\u1ebf m\u00e3 h\u00f3a AEAD. Sau \u0111\u00f3, h\u1ecd chu\u1ea9n b\u1ecb m\u1ed9t \u0111o\u1ea1n shellcode – t\u1ee9c l\u00e0 m\u00e3 \u0111\u1ed9c s\u1ebd \u0111\u01b0\u1ee3c th\u1ef1c thi. B\u1eb1ng c\u00e1ch l\u1ee3i d\u1ee5ng l\u1ed7i trong kernel, h\u1ecd ghi \u0111o\u1ea1n m\u00e3 n\u00e0y tr\u1ef1c ti\u1ebfp v\u00e0o b\u1ed9 nh\u1edb \u0111\u1ec7m c\u1ee7a m\u1ed9t file h\u1ec7 th\u1ed1ng quan tr\u1ecdng nh\u01b0 `\/usr\/bin\/su`.<\/p>\n

Khi h\u1ec7 th\u1ed1ng ho\u1eb7c ng\u01b0\u1eddi d\u00f9ng th\u1ef1c thi file n\u00e0y, kernel s\u1ebd t\u1ea3i n\u1ed9i dung \u0111\u00e3 b\u1ecb s\u1eeda \u0111\u1ed5i t\u1eeb page cache thay v\u00ec t\u1eeb \u0111\u0129a. K\u1ebft qu\u1ea3 l\u00e0 \u0111o\u1ea1n m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c ch\u1ea1y v\u1edbi quy\u1ec1n root.<\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng s\u1ee3 n\u1eb1m \u1edf ch\u1ed7: qu\u00e1 tr\u00ecnh n\u00e0y kh\u00f4ng c\u1ea7n race condition, kh\u00f4ng c\u1ea7n \u0111o\u00e1n \u0111\u1ecba ch\u1ec9 b\u1ed9 nh\u1edb, kh\u00f4ng c\u1ea7n khai th\u00e1c ph\u1ee9c t\u1ea1p. N\u00f3 \u1ed5n \u0111\u1ecbnh, c\u00f3 th\u1ec3 l\u1eb7p l\u1ea1i v\u00e0 ho\u1ea1t \u0111\u1ed9ng tr\u00ean nhi\u1ec1u h\u1ec7 th\u1ed1ng kh\u00e1c nhau.\u200b<\/p><\/div>\n

M\u1ee9c \u0111\u1ed9 nguy hi\u1ec3m: V\u00ec sao \u201cCopy Fail\u201d \u0111\u00e1ng lo h\u01a1n b\u1ea1n ngh\u0129?\u200b<\/div>\n
Tho\u1ea1t nh\u00ecn, \u0111\u00e2y l\u00e0 l\u1ed7 h\u1ed5ng c\u1ee5c b\u1ed9, ngh\u0129a l\u00e0 k\u1ebb t\u1ea5n c\u00f4ng ph\u1ea3i c\u00f3 quy\u1ec1n truy c\u1eadp v\u00e0o h\u1ec7 th\u1ed1ng tr\u01b0\u1edbc. Nh\u01b0ng trong b\u1ed1i c\u1ea3nh hi\u1ec7n nay, \u0111i\u1ec1u \u0111\u00f3 kh\u00f4ng c\u00f2n l\u00e0 r\u00e0o c\u1ea3n l\u1edbn.<\/p>\n

Trong m\u00f4i tr\u01b0\u1eddng server, container hay cloud, vi\u1ec7c c\u00f3 m\u1ed9t t\u00e0i kho\u1ea3n ng\u01b0\u1eddi d\u00f9ng h\u1ea1n ch\u1ebf l\u00e0 \u0111i\u1ec1u r\u1ea5t ph\u1ed5 bi\u1ebfn. V\u00e0 t\u1eeb \u0111i\u1ec3m kh\u1edfi \u0111\u1ea7u \u0111\u00f3, l\u1ed7 h\u1ed5ng n\u00e0y cho ph\u00e9p leo thang l\u00ean quy\u1ec1n root g\u1ea7n nh\u01b0 ch\u1eafc ch\u1eafn.<\/p>\n

\u0110\u00e1ng ch\u00fa \u00fd h\u01a1n, page cache trong Linux l\u00e0 t\u00e0i nguy\u00ean d\u00f9ng chung cho to\u00e0n h\u1ec7 th\u1ed1ng, bao g\u1ed3m c\u1ea3 c\u00e1c container. \u0110i\u1ec1u n\u00e0y \u0111\u1ed3ng ngh\u0129a v\u1edbi vi\u1ec7c m\u1ed9t container b\u1ecb x\u00e2m nh\u1eadp c\u00f3 th\u1ec3 \u1ea3nh h\u01b0\u1edfng sang container kh\u00e1c, ph\u00e1 v\u1ee1 m\u00f4 h\u00ecnh c\u00e1ch ly v\u1ed1n \u0111\u01b0\u1ee3c tin t\u01b0\u1edfng.<\/p>\n

C\u00e1c chuy\u00ean gia \u0111\u00e1nh gi\u00e1 l\u1ed7 h\u1ed5ng n\u00e0y h\u1ed9i t\u1ee5 b\u1ed1n y\u1ebfu t\u1ed1 hi\u1ebfm khi xu\u1ea5t hi\u1ec7n c\u00f9ng l\u00fac: nh\u1ecf g\u1ecdn, d\u1ec5 khai th\u00e1c, kh\u00f3 ph\u00e1t hi\u1ec7n v\u00e0 c\u00f3 kh\u1ea3 n\u0103ng ho\u1ea1t \u0111\u1ed9ng tr\u00ean nhi\u1ec1u h\u1ec7 th\u1ed1ng. N\u00f3 g\u1ee3i nh\u1edb \u0111\u1ebfn l\u1ed7 h\u1ed5ng Dirty Pipe (CVE-2022-0847) tr\u01b0\u1edbc \u0111\u00e2y, nh\u01b0ng l\u1ea7n n\u00e0y xu\u1ea5t hi\u1ec7n \u1edf m\u1ed9t th\u00e0nh ph\u1ea7n kh\u00e1c c\u1ee7a kernel.\u200b<\/p><\/div>\n

R\u1ee7i ro v\u00e0 h\u1eadu qu\u1ea3: Kh\u00f4ng ch\u1ec9 l\u00e0 chi\u1ebfm quy\u1ec1n, m\u00e0 l\u00e0 ki\u1ec3m so\u00e1t to\u00e0n b\u1ed9\u200b<\/div>\n
N\u1ebfu b\u1ecb khai th\u00e1c, h\u1eadu qu\u1ea3 kh\u00f4ng d\u1eebng l\u1ea1i \u1edf vi\u1ec7c n\u00e2ng quy\u1ec1n. Khi \u0111\u00e3 c\u00f3 quy\u1ec1n root, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3:\u200b<\/div>\n
    \n
  • \n
    C\u00e0i \u0111\u1eb7t backdoor \u0111\u1ec3 duy tr\u00ec quy\u1ec1n truy c\u1eadp l\u00e2u d\u00e0i\u200b<\/div>\n<\/li>\n
  • \n
    Tr\u00edch xu\u1ea5t d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m t\u1eeb h\u1ec7 th\u1ed1ng\u200b<\/div>\n<\/li>\n
  • \n
    T\u1eaft ho\u1eb7c qua m\u1eb7t c\u00e1c c\u01a1 ch\u1ebf b\u1ea3o m\u1eadt\u200b<\/div>\n<\/li>\n
  • \n
    Di chuy\u1ec3n ngang trong h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 ho\u1eb7c m\u00f4i tr\u01b0\u1eddng cloud\u200b<\/div>\n<\/li>\n
  • \n
    Can thi\u1ec7p v\u00e0o pipeline CI\/CD, bi\u1ebfn n\u00f3 th\u00e0nh \u0111i\u1ec3m ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c\u200b<\/div>\n<\/li>\n<\/ul>\n
    Trong m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p, \u0111i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn vi ph\u1ea1m d\u1eef li\u1ec7u quy m\u00f4 l\u1edbn, gi\u00e1n \u0111o\u1ea1n d\u1ecbch v\u1ee5, ho\u1eb7c th\u1eadm ch\u00ed l\u00e0 t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng.\u200b<\/div>\n
    Gi\u1ea3i ph\u00e1p v\u00e0 khuy\u1ebfn ngh\u1ecb: Kh\u00f4ng ph\u1ea3i l\u1ed7i \u201cl\u00fd thuy\u1ebft\u201d, c\u1ea7n h\u00e0nh \u0111\u1ed9ng ngay\u200b<\/div>\n
    Tin t\u00edch c\u1ef1c l\u00e0 c\u00e1c b\u1ea3n ph\u00e2n ph\u1ed1i Linux l\u1edbn \u0111\u00e3 b\u1eaft \u0111\u1ea7u ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1. Tuy nhi\u00ean, v\u1ea5n \u0111\u1ec1 th\u1ef1c t\u1ebf kh\u00f4ng n\u1eb1m \u1edf \u201cc\u00f3 b\u1ea3n v\u00e1 hay ch\u01b0a\u201d m\u00e0 l\u00e0 \u201c\u0111\u00e3 c\u1eadp nh\u1eadt hay ch\u01b0a\u201d.<\/p>\n

    C\u00e1c chuy\u00ean gia an ninh m\u1ea1ng khuy\u1ebfn ngh\u1ecb:\u200b<\/p><\/div>\n

      \n
    • \n
      C\u1eadp nh\u1eadt kernel v\u00e0 h\u1ec7 \u0111i\u1ec1u h\u00e0nh ngay khi c\u00f3 b\u1ea3n v\u00e1 ch\u00ednh th\u1ee9c t\u1eeb nh\u00e0 cung c\u1ea5p\u200b<\/div>\n<\/li>\n
    • \n
      R\u00e0 so\u00e1t c\u00e1c h\u1ec7 th\u1ed1ng s\u1eed d\u1ee5ng Linux, \u0111\u1eb7c bi\u1ec7t l\u00e0 server v\u00e0 m\u00f4i tr\u01b0\u1eddng cloud\u200b<\/div>\n<\/li>\n
    • \n
      H\u1ea1n ch\u1ebf quy\u1ec1n truy c\u1eadp c\u1ee7a ng\u01b0\u1eddi d\u00f9ng n\u1ed9i b\u1ed9, tr\u00e1nh c\u1ea5p quy\u1ec1n shell kh\u00f4ng c\u1ea7n thi\u1ebft\u200b<\/div>\n<\/li>\n
    • \n
      Gi\u00e1m s\u00e1t c\u00e1c h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng li\u00ean quan \u0111\u1ebfn file h\u1ec7 th\u1ed1ng v\u00e0 page cache\u200b<\/div>\n<\/li>\n
    • \n
      T\u0103ng c\u01b0\u1eddng b\u1ea3o m\u1eadt cho container, kh\u00f4\u200b<\/div>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

      M\u1ed9t l\u1ed7 h\u1ed5ng leo thang \u0111\u1eb7c quy\u1ec1n nghi\u00eam tr\u1ecdng v\u1eeba \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 trong nh\u00e2n Linux \u0111ang khi\u1ebfn c\u1ed9ng \u0111\u1ed3ng an ninh m\u1ea1ng hoang mang, kh\u00f4ng ph\u1ea3i v\u00ec n\u00f3 \u201cm\u1edbi toanh\u201d m\u00e0 v\u00ec n\u00f3 \u00e2m th\u1ea7m t\u1ed3n t\u1ea1i g\u1ea7n m\u1ed9t th\u1eadp k\u1ef7 trong l\u00f5i h\u1ec7 \u0111i\u1ec1u h\u00e0nh m\u00e0 h\u00e0ng t\u1ef7 thi\u1ebft b\u1ecb \u0111ang s\u1eed d\u1ee5ng. […]<\/p>\n","protected":false},"author":20,"featured_media":47810,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[3,24,35],"tags":[],"class_list":["post-47809","post","type-post","status-publish","format-standard","has-post-thumbnail","category-canh-bao-khuyen-nghi","category-tin-noi-bat","category-tin-tuc-su-kien"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/comments?post=47809"}],"version-history":[{"count":1,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47809\/revisions"}],"predecessor-version":[{"id":47811,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47809\/revisions\/47811"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media\/47810"}],"wp:attachment":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media?parent=47809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/categories?post=47809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/tags?post=47809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}