{"id":2277,"date":"2026-07-02T10:13:34","date_gmt":"2026-07-02T02:13:34","guid":{"rendered":"https:\/\/www.o6s.net\/?p=2277"},"modified":"2026-07-16T22:42:55","modified_gmt":"2026-07-16T14:42:55","slug":"%e7%b4%a7%e6%80%a5%e5%ae%89%e5%85%a8%e6%9b%b4%e6%96%b0-linux-kernel-actpedit-%e6%9c%ac%e5%9c%b0%e6%8f%90%e6%9d%83%e6%bc%8f%e6%b4%9e%e4%bf%ae%e5%a4%8d%ef%bc%8c%e8%af%b7%e5%b0%bd%e5%bf%ab%e5%8d%87","status":"publish","type":"post","link":"https:\/\/www.o6s.net\/index.php\/2026\/07\/02\/%e7%b4%a7%e6%80%a5%e5%ae%89%e5%85%a8%e6%9b%b4%e6%96%b0-linux-kernel-actpedit-%e6%9c%ac%e5%9c%b0%e6%8f%90%e6%9d%83%e6%bc%8f%e6%b4%9e%e4%bf%ae%e5%a4%8d%ef%bc%8c%e8%af%b7%e5%b0%bd%e5%bf%ab%e5%8d%87\/","title":{"rendered":"\u7d27\u6025\u5b89\u5168\u66f4\u65b0 | Linux Kernel ActPedit \u672c\u5730\u63d0\u6743\u6f0f\u6d1e\u4fee\u590d\uff0c\u8bf7\u5c3d\u5feb\u5347\u7ea7\uff01"},"content":{"rendered":"
\"\u56fe\u7247\"<\/section>\n

\ud83d\udd14<\/span><\/span>\u00a0\u4eb2\u7231\u7684 deepin \u7528\u6237\u4e0e\u793e\u533a\u4f19\u4f34\u4eec\uff1a<\/span><\/span><\/span><\/span><\/span><\/p>\n

\u8fd1\u671f\uff0cLinux Kernel \u88ab\u62ab\u9732\u5b58\u5728\u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u4ee3\u53f7\u4e3a\u00a0<\/span><\/span>ActPedit<\/span><\/span><\/strong>\uff08\u4e5f\u79f0\u00a0<\/span><\/span>pedit COW<\/span><\/span><\/strong>\uff09\u3002\u8be5\u6f0f\u6d1e\u4e0e\u6b64\u524d\u00a0<\/span><\/span>Dirty Frag<\/span><\/a><\/span>\u3001<\/span><\/span>Copy Fail<\/span><\/a><\/span>\u00a0\u5c5e\u4e8e\u540c\u4e00\u7c7b page cache \u5199\u5165\u98ce\u9669\u3002\u653b\u51fb\u8005\u5728\u5df2\u83b7\u5f97\u672c\u5730\u4f4e\u6743\u9650\u6267\u884c\u6761\u4ef6\u7684\u60c5\u51b5\u4e0b\uff0c\u53ef\u80fd\u5229\u7528\u8be5\u6f0f\u6d1e\u7be1\u6539\u53ea\u8bfb\u6587\u4ef6\u7684 page cache\uff0c\u8fdb\u4e00\u6b65\u63d0\u5347\u6743\u9650\u5e76\u83b7\u53d6 root \u6743\u9650\u3002<\/span><\/span><\/p>\n

\u76ee\u524d\u516c\u5f00\u8d44\u6599\u663e\u793a\uff0c\u8be5\u6f0f\u6d1e\u7684 PoC\uff08\u6982\u5ff5\u9a8c\u8bc1\u4ee3\u7801\uff09\u548c\u5229\u7528\u6280\u672f\u7ec6\u8282\u5df2\u516c\u5f00\u4f20\u64ad\u3002\u9274\u4e8e\u5176\u4e25\u91cd\u6027\u548c\u5e7f\u6cdb\u5f71\u54cd\uff0c\u4e3a\u786e\u4fdd\u60a8\u7684\u7cfb\u7edf\u5b89\u5168\uff0c\u6211\u4eec\u5f3a\u70c8\u5efa\u8bae\u6240\u6709\u7528\u6237\u5c3d\u5feb\u5347\u7ea7\u3002<\/span><\/span><\/p>\n

\u00a0<\/span><\/p>\n

\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

01<\/strong><\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

\n
\n
\n

\u6f0f\u6d1e\u4fe1\u606f<\/span><\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

\u6f0f\u6d1e\u7f16\u53f7\uff1a<\/span><\/span>\u00a0CVE-2026-46331<\/span><\/p>\n

\u6f0f\u6d1e\u4ee3\u53f7\uff1a\u00a0<\/span>ActPedit\uff08pedit COW\uff09<\/span><\/span><\/span><\/p>\n

\u6f0f\u6d1e\u63cf\u8ff0\uff1a<\/span>Linux \u5185\u6838\u6d41\u91cf\u63a7\u5236\u5305\u7f16\u8f91\uff08pedit\uff09\u5b50\u7cfb\u7edf\u5b58\u5728\u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002tcf_pedit_act() \u5728\u5904\u7406\u5199\u65f6\u590d\u5236\uff08COW\uff09\u65f6\uff0c\u672a\u5c06\u8fd0\u884c\u65f6\u5934\u90e8\u504f\u79fb\u91cf\u7eb3\u5165 skb_ensure_writable() \u7684\u5199\u5165\u8303\u56f4\u8ba1\u7b97\uff0c\u53ef\u80fd\u5bfc\u81f4\u90e8\u5206\u5199\u5165\u533a\u57df\u672a\u6b63\u786e COW\uff0c\u8fdb\u800c\u9020\u6210\u8d8a\u754c\u5199\u5165\u548c\u9875\u9762\u7f13\u5b58\u635f\u574f\u3002\u5177\u5907\u6d41\u91cf\u63a7\u5236\u89c4\u5219\u914d\u7f6e\u80fd\u529b\u7684\u672c\u5730\u653b\u51fb\u8005\uff0c\u53ef\u80fd\u5229\u7528\u8be5\u7f3a\u9677\u63d0\u5347\u6743\u9650\u6216\u5bfc\u81f4\u7cfb\u7edf\u5d29\u6e83\u3002<\/span><\/span><\/p>\n

\u6f0f\u6d1e\u7b49\u7ea7\uff1a<\/span>\u9ad8\u5371<\/span><\/span>\uff08CVSS 7.1-7.8\uff09<\/span><\/p>\n

\u5229\u7528\u6761\u4ef6\uff1a<\/span><\/span>\u5185\u6838\u542f\u7528 CONFIG_NET_ACT_PEDIT\uff0c\u4e14\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u672c\u5730\u6743\u9650\u8def\u5f84\u914d\u7f6e\u6d41\u91cf\u63a7\u5236\u89c4\u5219\uff1b\u5f53\u7cfb\u7edf\u542f\u7528\u7528\u6237\u547d\u540d\u7a7a\u95f4\uff08CONFIG_USER_NS=y\uff0c\u4e14 \/proc\/sys\/kernel\/unprivileged_userns_clone \u4e3a 1\uff09\u65f6\uff0c\u516c\u5f00 PoC \u5229\u7528\u98ce\u9669\u66f4\u9ad8\u3002\u6210\u529f\u5229\u7528\u540e\uff0c\u672c\u5730\u666e\u901a\u7528\u6237\u53ef\u76f4\u63a5\u83b7\u53d6\u7cfb\u7edf root \u6700\u9ad8\u6743\u9650\uff0c\u5b9e\u73b0\u5b8c\u5168\u63a7\u5236\u3002<\/span><\/span><\/p>\n

\u5f71\u54cd\u8303\u56f4\uff1a<\/span><\/span>\u6240\u6709\u672a\u66f4\u65b0\u672c\u6b21\u4fee\u590d\u7684 deepin 25 \u7528\u6237\u5747\u53d7\u5f71\u54cd\uff0c\u5efa\u8bae\u7acb\u5373\u66f4\u65b0\u5347\u7ea7\u3002<\/span><\/span><\/p>\n

\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

02<\/strong><\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

\n
\n
\n

\u4fee\u590d\u8fdb\u5c55<\/span><\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

deepin 25\uff086.6 \u53ca 6.18 \u5185\u6838\uff09\uff1a<\/span><\/span><\/p>\n

\u9488\u5bf9 deepin25 \u7684 ActPedit \u6f0f\u6d1e\u4fee\u590d\u66f4\u65b0\u5df2\u5b8c\u6210\u63a8\u9001 \uff0c\u8bf7\u5c3d\u5feb\u901a\u8fc7<\/span><\/span>\u63a7\u5236\u4e2d\u5fc3<\/span><\/span>\u66f4\u65b0<\/span>\uff0c\u6216<\/span>\u4f7f\u7528<\/span><\/span>\u7ec8\u7aef<\/span><\/span>\u547d\u4ee4\u5347\u7ea7<\/span>\uff1a<\/span><\/span><\/p>\n

\n