Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-12411

Опубликовано: 18 сент. 2025
Источник: fstec
CVSS3: 5.5
CVSS2: 4.6
EPSS Низкий

Описание

Уязвимость ядра операционной системы Linux связана с использованием памяти после ее освобождения. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Вендор

Сообщество свободного программного обеспечения

Наименование ПО

Debian GNU/Linux
Linux

Версия ПО

11 (Debian GNU/Linux)
до 6.3 (Linux)
от 5.15 до 5.15.107 (Linux)
от 6.1 до 6.1.24 (Linux)
от 6.2 до 6.2.11 (Linux)
от 3.17 до 4.14.313 (Linux)
от 4.19 до 4.19.281 (Linux)
от 5.4 до 5.4.241 (Linux)
от 5.10 до 5.10.178 (Linux)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Сообщество свободного программного обеспечения Debian GNU/Linux 11
Сообщество свободного программного обеспечения Linux до 6.3
Сообщество свободного программного обеспечения Linux от 5.15 до 5.15.107
Сообщество свободного программного обеспечения Linux от 6.1 до 6.1.24
Сообщество свободного программного обеспечения Linux от 6.2 до 6.2.11
Сообщество свободного программного обеспечения Linux от 3.17 до 4.14.313
Сообщество свободного программного обеспечения Linux от 4.19 до 4.19.281
Сообщество свободного программного обеспечения Linux от 5.4 до 5.4.241
Сообщество свободного программного обеспечения Linux от 5.10 до 5.10.178

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 4,6)
Средний уровень опасности (базовая оценка CVSS 3.1 составляет 5,5)

Возможные меры по устранению уязвимости

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Linux:
https://lore.kernel.org/linux-cve-announce/2025091859-CVE-2023-53440-cd1e@gregkh/
https://git.kernel.org/stable/c/1942ccb7d95f287a312fcbabfa8bc9ba501b1953
https://git.kernel.org/stable/c/3dbee84bf9e3273c4bb9ca6fc18ff22fba23dd24
https://git.kernel.org/stable/c/42560f9c92cc43dce75dbf06cc0d840dced39b12
https://git.kernel.org/stable/c/5fe0ea141fbb887d407f1bf572ebf24427480d5c
https://git.kernel.org/stable/c/83b16a60e413148685739635901937e2f16a7873
https://git.kernel.org/stable/c/d20dcec8f326deb77b6688f8441e014045dac457
https://git.kernel.org/stable/c/d540aea451ab5489777a8156560f1388449b3109
https://git.kernel.org/stable/c/daf4eb3a908b108279b60172d2f176e70d2df875
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2023-53440

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 4%
0.00018
Низкий

5.5 Medium

CVSS3

4.6 Medium

CVSS2

Связанные уязвимости

CVSS3: 5.5
ubuntu
5 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix sysfs interface lifetime The current nilfs2 sysfs support has issues with the timing of creation and deletion of sysfs entries, potentially leading to null pointer dereferences, use-after-free, and lockdep warnings. Some of the sysfs attributes for nilfs2 per-filesystem instance refer to metadata file "cpfile", "sufile", or "dat", but nilfs_sysfs_create_device_group that creates those attributes is executed before the inodes for these metadata files are loaded, and nilfs_sysfs_delete_device_group which deletes these sysfs entries is called after releasing their metadata file inodes. Therefore, access to some of these sysfs attributes may occur outside of the lifetime of these metadata files, resulting in inode NULL pointer dereferences or use-after-free. In addition, the call to nilfs_sysfs_create_device_group() is made during the locking period of the semaphore "ns_sem" of nilfs object, so the shrinker ...

CVSS3: 5.5
redhat
5 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix sysfs interface lifetime The current nilfs2 sysfs support has issues with the timing of creation and deletion of sysfs entries, potentially leading to null pointer dereferences, use-after-free, and lockdep warnings. Some of the sysfs attributes for nilfs2 per-filesystem instance refer to metadata file "cpfile", "sufile", or "dat", but nilfs_sysfs_create_device_group that creates those attributes is executed before the inodes for these metadata files are loaded, and nilfs_sysfs_delete_device_group which deletes these sysfs entries is called after releasing their metadata file inodes. Therefore, access to some of these sysfs attributes may occur outside of the lifetime of these metadata files, resulting in inode NULL pointer dereferences or use-after-free. In addition, the call to nilfs_sysfs_create_device_group() is made during the locking period of the semaphore "ns_sem" of nilfs object, so the shrinker ...

CVSS3: 5.5
nvd
5 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix sysfs interface lifetime The current nilfs2 sysfs support has issues with the timing of creation and deletion of sysfs entries, potentially leading to null pointer dereferences, use-after-free, and lockdep warnings. Some of the sysfs attributes for nilfs2 per-filesystem instance refer to metadata file "cpfile", "sufile", or "dat", but nilfs_sysfs_create_device_group that creates those attributes is executed before the inodes for these metadata files are loaded, and nilfs_sysfs_delete_device_group which deletes these sysfs entries is called after releasing their metadata file inodes. Therefore, access to some of these sysfs attributes may occur outside of the lifetime of these metadata files, resulting in inode NULL pointer dereferences or use-after-free. In addition, the call to nilfs_sysfs_create_device_group() is made during the locking period of the semaphore "ns_sem" of nilfs object, so the shrinke

CVSS3: 5.5
debian
5 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: n ...

CVSS3: 5.5
github
5 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix sysfs interface lifetime The current nilfs2 sysfs support has issues with the timing of creation and deletion of sysfs entries, potentially leading to null pointer dereferences, use-after-free, and lockdep warnings. Some of the sysfs attributes for nilfs2 per-filesystem instance refer to metadata file "cpfile", "sufile", or "dat", but nilfs_sysfs_create_device_group that creates those attributes is executed before the inodes for these metadata files are loaded, and nilfs_sysfs_delete_device_group which deletes these sysfs entries is called after releasing their metadata file inodes. Therefore, access to some of these sysfs attributes may occur outside of the lifetime of these metadata files, resulting in inode NULL pointer dereferences or use-after-free. In addition, the call to nilfs_sysfs_create_device_group() is made during the locking period of the semaphore "ns_sem" of nilfs object, so the shri...

EPSS

Процентиль: 4%
0.00018
Низкий

5.5 Medium

CVSS3

4.6 Medium

CVSS2