Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-13519

Опубликовано: 25 июл. 2025
Источник: fstec
CVSS3: 8
CVSS2: 7.7
EPSS Низкий

Описание

Уязвимость функции pcibios_bus_to_resource ядра операционной системы Linux связана с копированием буфера без проверки входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Вендор

Red Hat Inc.
Сообщество свободного программного обеспечения

Наименование ПО

Red Hat Enterprise Linux
Linux

Версия ПО

9 (Red Hat Enterprise Linux)
10 (Red Hat Enterprise Linux)
от 6.15 до 6.15.4 (Linux)
до 6.16 rc1 (Linux)
от 6.6.45 до 6.6.95 (Linux)
от 6.9 до 6.12.35 (Linux)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Red Hat Inc. Red Hat Enterprise Linux 9
Red Hat Inc. Red Hat Enterprise Linux 10
Сообщество свободного программного обеспечения Linux от 6.15 до 6.15.4
Сообщество свободного программного обеспечения Linux до 6.16 rc1
Сообщество свободного программного обеспечения Linux от 6.6.45 до 6.6.95
Сообщество свободного программного обеспечения Linux от 6.9 до 6.12.35

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,7)
Высокий уровень опасности (базовая оценка CVSS 3.1 составляет 8)

Возможные меры по устранению уязвимости

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Linux:
https://lore.kernel.org/linux-cve-announce/2025072555-CVE-2025-38427-6e37@gregkh/
https://git.kernel.org/stable/c/2f29b5c231011b94007d2c8a6d793992f2275db1
https://git.kernel.org/stable/c/5c70e3ad85d2890d8af375333699429de26327f2
https://git.kernel.org/stable/c/aeda386d86d79269a08f470dbdc53d13a91e51fa
https://git.kernel.org/stable/c/cc3cc41ed67054a03134bea42408c720eec0fa04
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/CVE-2025-38427

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 6%
0.00026
Низкий

8 High

CVSS3

7.7 High

CVSS2

Связанные уязвимости

ubuntu
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: video: screen_info: Relocate framebuffers behind PCI bridges Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes invalid access to I/O memory. Resources behind a PCI host bridge can be relocated by a certain offset in the kernel's CPU address range used for I/O. The framebuffer memory range stored in screen_info refers to the CPU addresses as seen during boot (where the offset is 0). During boot up, firmware may assign a different memory offset to the PCI host bridge and thereby relocating the framebuffer address of the PCI graphics device as seen by the kernel. The information in screen_info must be updated as well. The helper pcibios_bus_to_resource() performs the relocation of the screen_info's framebuffer resource (given in PCI bus addresses). The result matches the I/O-memory resource of the PCI graphics device (given in CPU addresses). As before, we store away the information necessary to l...

CVSS3: 7
redhat
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: video: screen_info: Relocate framebuffers behind PCI bridges Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes invalid access to I/O memory. Resources behind a PCI host bridge can be relocated by a certain offset in the kernel's CPU address range used for I/O. The framebuffer memory range stored in screen_info refers to the CPU addresses as seen during boot (where the offset is 0). During boot up, firmware may assign a different memory offset to the PCI host bridge and thereby relocating the framebuffer address of the PCI graphics device as seen by the kernel. The information in screen_info must be updated as well. The helper pcibios_bus_to_resource() performs the relocation of the screen_info's framebuffer resource (given in PCI bus addresses). The result matches the I/O-memory resource of the PCI graphics device (given in CPU addresses). As before, we store away the information necessary to l...

nvd
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: video: screen_info: Relocate framebuffers behind PCI bridges Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes invalid access to I/O memory. Resources behind a PCI host bridge can be relocated by a certain offset in the kernel's CPU address range used for I/O. The framebuffer memory range stored in screen_info refers to the CPU addresses as seen during boot (where the offset is 0). During boot up, firmware may assign a different memory offset to the PCI host bridge and thereby relocating the framebuffer address of the PCI graphics device as seen by the kernel. The information in screen_info must be updated as well. The helper pcibios_bus_to_resource() performs the relocation of the screen_info's framebuffer resource (given in PCI bus addresses). The result matches the I/O-memory resource of the PCI graphics device (given in CPU addresses). As before, we store away the information necessary to

debian
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: v ...

github
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: video: screen_info: Relocate framebuffers behind PCI bridges Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes invalid access to I/O memory. Resources behind a PCI host bridge can be relocated by a certain offset in the kernel's CPU address range used for I/O. The framebuffer memory range stored in screen_info refers to the CPU addresses as seen during boot (where the offset is 0). During boot up, firmware may assign a different memory offset to the PCI host bridge and thereby relocating the framebuffer address of the PCI graphics device as seen by the kernel. The information in screen_info must be updated as well. The helper pcibios_bus_to_resource() performs the relocation of the screen_info's framebuffer resource (given in PCI bus addresses). The result matches the I/O-memory resource of the PCI graphics device (given in CPU addresses). As before, we store away the information necessary ...

EPSS

Процентиль: 6%
0.00026
Низкий

8 High

CVSS3

7.7 High

CVSS2