Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-13607

Опубликовано: 15 июл. 2025
Источник: fstec
CVSS3: 7
CVSS2: 6
EPSS Низкий

Описание

Уязвимость функции complete_emulated_io() ядра операционной системы Linux связана с ошибками обработки разрешений. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Вендор

Red Hat Inc.
Сообщество свободного программного обеспечения

Наименование ПО

Red Hat Enterprise Linux
Linux

Версия ПО

7 (Red Hat Enterprise Linux)
8 (Red Hat Enterprise Linux)
9 (Red Hat Enterprise Linux)
10 (Red Hat Enterprise Linux)
до 6.18 rc1 (Linux)
от 3.0 до 5.15.195 (Linux)
от 6.1 до 6.1.157 (Linux)
от 6.6 до 6.6.111 (Linux)
от 6.12 до 6.12.52 (Linux)
от 6.16 до 6.16.12 (Linux)
от 6.17 до 6.17.2 (Linux)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Red Hat Inc. Red Hat Enterprise Linux 7
Red Hat Inc. Red Hat Enterprise Linux 8
Red Hat Inc. Red Hat Enterprise Linux 9
Red Hat Inc. Red Hat Enterprise Linux 10
Сообщество свободного программного обеспечения Linux до 6.18 rc1
Сообщество свободного программного обеспечения Linux от 3.0 до 5.15.195
Сообщество свободного программного обеспечения Linux от 6.1 до 6.1.157
Сообщество свободного программного обеспечения Linux от 6.6 до 6.6.111
Сообщество свободного программного обеспечения Linux от 6.12 до 6.12.52
Сообщество свободного программного обеспечения Linux от 6.16 до 6.16.12
Сообщество свободного программного обеспечения Linux от 6.17 до 6.17.2

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 6)
Высокий уровень опасности (базовая оценка CVSS 3.1 составляет 7)

Возможные меры по устранению уязвимости

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Linux:
https://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40026-760b@gregkh/
https://git.kernel.org/stable/c/3a062a5c55adc5507600b9ae6d911e247e2f1d6e
https://git.kernel.org/stable/c/3d3abf3f7e8b1abb082070a343de82d7efc80523
https://git.kernel.org/stable/c/7366830642505683bbe905a2ba5d18d6e4b512b8
https://git.kernel.org/stable/c/ba35a5d775799ce5ad60230be97336f2fefd518e
https://git.kernel.org/stable/c/e0ce3ed1048a47986d15aef1a98ebda25560d257
https://git.kernel.org/stable/c/e7177c7e32cb806f348387b7f4faafd4a5b32054
https://git.kernel.org/stable/c/e750f85391286a4c8100275516973324b621a269
Для продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2025-40026

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 12%
0.00041
Низкий

7 High

CVSS3

6 Medium

CVSS2

Связанные уязвимости

ubuntu
13 дней назад

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O...

nvd
13 дней назад

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/

msrc
13 дней назад

KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

debian
13 дней назад

In the Linux kernel, the following vulnerability has been resolved: K ...

github
13 дней назад

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port...

EPSS

Процентиль: 12%
0.00041
Низкий

7 High

CVSS3

6 Medium

CVSS2