Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-04452

Опубликовано: 22 янв. 2025
Источник: fstec
CVSS3: 4.8
CVSS2: 4.3
EPSS Низкий

Описание

Уязвимость функции perf_event_swap_task_ctx_data ядра операционной системы Linux связана с исчерпанием ресурсов центрального процессора. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Вендор

Canonical Ltd.
Red Hat Inc.
Novell Inc.
Сообщество свободного программного обеспечения
АО "НППКТ"

Наименование ПО

Ubuntu
Red Hat Enterprise Linux
Suse Linux Enterprise Desktop
Suse Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
OpenSUSE Leap
Linux
ОСОН ОСнова Оnyx

Версия ПО

22.04 LTS (Ubuntu)
9 (Red Hat Enterprise Linux)
15 SP6 (Suse Linux Enterprise Desktop)
15 SP6 (Suse Linux Enterprise Server)
15 SP6 (SUSE Linux Enterprise Server for SAP Applications)
24.04 LTS (Ubuntu)
15.6 (OpenSUSE Leap)
24.10 (Ubuntu)
от 6.2 до 6.13.6 (Linux)
от 6.2 до 6.6.81 (Linux)
от 6.2 до 6.12.18 (Linux)
от 6.2 до 6.14 (Linux)
до 2.13 (ОСОН ОСнова Оnyx)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Canonical Ltd. Ubuntu 22.04 LTS
Red Hat Inc. Red Hat Enterprise Linux 9
Novell Inc. Suse Linux Enterprise Desktop 15 SP6
Novell Inc. Suse Linux Enterprise Server 15 SP6
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP6
Canonical Ltd. Ubuntu 24.04 LTS
Novell Inc. OpenSUSE Leap 15.6
Canonical Ltd. Ubuntu 24.10
Сообщество свободного программного обеспечения Linux от 6.2 до 6.13.6
Сообщество свободного программного обеспечения Linux от 6.2 до 6.6.81
Сообщество свободного программного обеспечения Linux от 6.2 до 6.12.18
Сообщество свободного программного обеспечения Linux от 6.2 до 6.14
АО "НППКТ" ОСОН ОСнова Оnyx до 2.13

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 4,3)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 4,8)

Возможные меры по устранению уязвимости

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Linux:
https://git.kernel.org/stable/c/2016066c66192a99d9e0ebf433789c490a6785a2
https://git.kernel.org/stable/c/3e812a70732d84b7873cea61a7f6349b9a9dcbf5
https://git.kernel.org/stable/c/7d582eb6e4e100959ba07083d7563453c8c2a343
https://git.kernel.org/stable/c/f0c3971405cef6892844016aa710121a02da3a23
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21895-5c1a@gregkh/
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2025-21895
Для Ubuntu:
https://ubuntu.com/security/CVE-2025-21895
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2025-21895.html
Обновление программного обеспечения linux до версии 6.6.90-0.osnova2u1

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 6%
0.00026
Низкий

4.8 Medium

CVSS3

4.3 Medium

CVSS2

Связанные уязвимости

ubuntu
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same perf_event_pmu_context, but not in the same order. The problem is that the order of pmu_ctx_list for the parent is impacted by the time when an event/PMU is added. While the order for a child is impacted by the event order in the pinned_groups and flexible_groups. So the order of pmu_ctx_list in the parent and child may be different. To fix this problem, insert the perf_event_pmu_context to its proper place after iteration of the pmu_ctx_list. The follow testcase can trigger above warning: # perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out & # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out test.c void main() { int count = 0; pid_t pid; printf("%d running\n", getpid(...

CVSS3: 2.5
redhat
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same perf_event_pmu_context, but not in the same order. The problem is that the order of pmu_ctx_list for the parent is impacted by the time when an event/PMU is added. While the order for a child is impacted by the event order in the pinned_groups and flexible_groups. So the order of pmu_ctx_list in the parent and child may be different. To fix this problem, insert the perf_event_pmu_context to its proper place after iteration of the pmu_ctx_list. The follow testcase can trigger above warning: # perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out & # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out test.c void main() { int count = 0; pid_t pid; printf("%d running\n", getpid()); sleep...

nvd
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same perf_event_pmu_context, but not in the same order. The problem is that the order of pmu_ctx_list for the parent is impacted by the time when an event/PMU is added. While the order for a child is impacted by the event order in the pinned_groups and flexible_groups. So the order of pmu_ctx_list in the parent and child may be different. To fix this problem, insert the perf_event_pmu_context to its proper place after iteration of the pmu_ctx_list. The follow testcase can trigger above warning: # perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out & # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out test.c void main() { int count = 0; pid_t pid; print

debian
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: p ...

github
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same perf_event_pmu_context, but not in the same order. The problem is that the order of pmu_ctx_list for the parent is impacted by the time when an event/PMU is added. While the order for a child is impacted by the event order in the pinned_groups and flexible_groups. So the order of pmu_ctx_list in the parent and child may be different. To fix this problem, insert the perf_event_pmu_context to its proper place after iteration of the pmu_ctx_list. The follow testcase can trigger above warning: # perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out & # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out test.c void main() { int count = 0; pid_t pid; pr...

EPSS

Процентиль: 6%
0.00026
Низкий

4.8 Medium

CVSS3

4.3 Medium

CVSS2