Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog
Консоль
Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog

exploitDog

fstec Π»ΠΎΠ³ΠΎΡ‚ΠΈΠΏ

BDU:2025-14969

ΠžΠΏΡƒΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½ΠΎ: 07 июл. 2025
Π˜ΡΡ‚ΠΎΡ‡Π½ΠΈΠΊ: fstec
CVSS3: 5.5
CVSS2: 4.6
EPSS Низкий

ОписаниС

Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ ΠΊΠΎΠΌΠΏΠΎΠ½Π΅Π½Ρ‚Π° /net/phy/phy_device.c ядра ΠΎΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΎΠ½Π½ΠΎΠΉ систСмы Linux связана c Π²Π·Π°ΠΈΠΌΠ½ΠΎΠΉ Π±Π»ΠΎΠΊΠΈΡ€ΠΎΠ²ΠΊΠΎΠΉ ΠΏΠΎΡ‚ΠΎΠΊΠΎΠ² выполнСния. Эксплуатация уязвимости позволяСт Π½Π°Ρ€ΡƒΡˆΠΈΡ‚Π΅Π»ΡŽ Π²Ρ‹Π·Π²Π°Ρ‚ΡŒ ΠΎΡ‚ΠΊΠ°Π· Π² обслуТивании

Π’Π΅Π½Π΄ΠΎΡ€

Red Hat Inc.
Canonical Ltd.
ООО Β«Π ΡƒΡΠ‘Π˜Π’Π΅Ρ…-Астра»
БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния
ООО Β«Π Π΅Π΄ Π‘ΠΎΡ„Ρ‚Β»
АО Β«Π‘Π±Π΅Ρ€Π’Π΅Ρ…Β»

НаимСнованиС ПО

Red Hat Enterprise Linux
Ubuntu
Astra Linux Special Edition
Linux
Debian GNU/Linux
Π Π•Π” ОБ
Platform V SberLinux OS Server

ВСрсия ПО

9 (Red Hat Enterprise Linux)
24.04 LTS (Ubuntu)
1.8 (Astra Linux Special Edition)
25.04 (Ubuntu)
10 (Red Hat Enterprise Linux)
Π΄ΠΎ 6.16 (Linux)
13 (Debian GNU/Linux)
ΠΎΡ‚ 6.12 Π΄ΠΎ 6.12.40 (Linux)
ΠΎΡ‚ 6.15 Π΄ΠΎ 6.15.8 (Linux)
ΠΎΡ‚ 6.6 Π΄ΠΎ 6.6.100 (Linux)
8.0 (Π Π•Π” ОБ)
9.2.0-fstec (Platform V SberLinux OS Server)

Вип ПО

ΠžΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΎΠ½Π½Π°Ρ систСма

ΠžΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΎΠ½Π½Ρ‹Π΅ систСмы ΠΈ Π°ΠΏΠΏΠ°Ρ€Π°Ρ‚Π½Ρ‹Π΅ ΠΏΠ»Π°Ρ‚Ρ„ΠΎΡ€ΠΌΡ‹

Red Hat Inc. Red Hat Enterprise Linux 9
Canonical Ltd. Ubuntu 24.04 LTS
ООО Β«Π ΡƒΡΠ‘Π˜Π’Π΅Ρ…-Астра» Astra Linux Special Edition 1.8
Canonical Ltd. Ubuntu 25.04
Red Hat Inc. Red Hat Enterprise Linux 10
БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния Linux Π΄ΠΎ 6.16
БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния Debian GNU/Linux 13
БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния Linux ΠΎΡ‚ 6.12 Π΄ΠΎ 6.12.40
БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния Linux ΠΎΡ‚ 6.15 Π΄ΠΎ 6.15.8
БообщСство свободного ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½ΠΎΠ³ΠΎ обСспСчСния Linux ΠΎΡ‚ 6.6 Π΄ΠΎ 6.6.100
ООО Β«Π Π΅Π΄ Π‘ΠΎΡ„Ρ‚Β» Π Π•Π” ОБ 8.0
АО Β«Π‘Π±Π΅Ρ€Π’Π΅Ρ…Β» Platform V SberLinux OS Server 9.2.0-fstec

Π£Ρ€ΠΎΠ²Π΅Π½ΡŒ опасности уязвимости

Π‘Ρ€Π΅Π΄Π½ΠΈΠΉ ΡƒΡ€ΠΎΠ²Π΅Π½ΡŒ опасности (базовая ΠΎΡ†Π΅Π½ΠΊΠ° CVSS 2.0 составляСт 4,6)
Π‘Ρ€Π΅Π΄Π½ΠΈΠΉ ΡƒΡ€ΠΎΠ²Π΅Π½ΡŒ опасности (базовая ΠΎΡ†Π΅Π½ΠΊΠ° CVSS 3.1 составляСт 5,5)

Π’ΠΎΠ·ΠΌΠΎΠΆΠ½Ρ‹Π΅ ΠΌΠ΅Ρ€Ρ‹ ΠΏΠΎ ΡƒΡΡ‚Ρ€Π°Π½Π΅Π½ΠΈΡŽ уязвимости

Π’ условиях отсутствия ΠΎΠ±Π½ΠΎΠ²Π»Π΅Π½ΠΈΠΉ бСзопасности ΠΎΡ‚ производитСля рСкомСндуСтся ΠΏΡ€ΠΈΠ΄Π΅Ρ€ΠΆΠΈΠ²Π°Ρ‚ΡŒΡΡ "Π Π΅ΠΊΠΎΠΌΠ΅Π½Π΄Π°Ρ†ΠΈΠΉ ΠΏΠΎ бСзопасной настройкС ΠΎΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΎΠ½Π½Ρ‹Ρ… систСм LINUX", ΠΈΠ·Π»ΠΎΠΆΠ΅Π½Π½Ρ‹Ρ… Π² мСтодичСском Π΄ΠΎΠΊΡƒΠΌΠ΅Π½Ρ‚Π΅ ЀБВЭК России, ΡƒΡ‚Π²Π΅Ρ€ΠΆΠ΄Ρ‘Π½Π½ΠΎΠΌ 25 дСкабря 2022 Π³ΠΎΠ΄Π°.
ИспользованиС Ρ€Π΅ΠΊΠΎΠΌΠ΅Π½Π΄Π°Ρ†ΠΈΠΉ:
Для Linux:
https://lore.kernel.org/linux-cve-announce/2025081657-CVE-2025-38537-180a@gregkh/
Для ΠΏΡ€ΠΎΠ³Ρ€Π°ΠΌΠΌΠ½Ρ‹Ρ… ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚ΠΎΠ² Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2025-38537
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2025-38537
Для Ubuntu:
https://ubuntu.com/security/CVE-2025-38537
Для ОБ Astra Linux:
- ΠΎΠ±Π½ΠΎΠ²ΠΈΡ‚ΡŒ ΠΏΠ°ΠΊΠ΅Ρ‚ linux-6.12 Π΄ΠΎ 6.12.47-1.astra1+ci8 ΠΈΠ»ΠΈ Π±ΠΎΠ»Π΅Π΅ высокой вСрсии, ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΡƒΡ Ρ€Π΅ΠΊΠΎΠΌΠ΅Π½Π΄Π°Ρ†ΠΈΠΈ производитСля: https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18
- ΠΎΠ±Π½ΠΎΠ²ΠΈΡ‚ΡŒ ΠΏΠ°ΠΊΠ΅Ρ‚ linux-6.6 Π΄ΠΎ 6.12.47-1.astra1+ci8 ΠΈΠ»ΠΈ Π±ΠΎΠ»Π΅Π΅ высокой вСрсии, ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΡƒΡ Ρ€Π΅ΠΊΠΎΠΌΠ΅Π½Π΄Π°Ρ†ΠΈΠΈ производитСля: https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18
Для Π Π΅Π΄ ОБ:
https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2025-38537

Бтатус уязвимости

ΠŸΠΎΠ΄Ρ‚Π²Π΅Ρ€ΠΆΠ΄Π΅Π½Π° ΠΏΡ€ΠΎΠΈΠ·Π²ΠΎΠ΄ΠΈΡ‚Π΅Π»Π΅ΠΌ

НаличиС эксплойта

Π”Π°Π½Π½Ρ‹Π΅ ΡƒΡ‚ΠΎΡ‡Π½ΡΡŽΡ‚ΡΡ

Π˜Π½Ρ„ΠΎΡ€ΠΌΠ°Ρ†ΠΈΡ ΠΎΠ± устранСнии

Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ устранСна

Π˜Π΄Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ‚ΠΎΡ€Ρ‹ Π΄Ρ€ΡƒΠ³ΠΈΡ… систСм описаний уязвимостСй

EPSS

ΠŸΡ€ΠΎΡ†Π΅Π½Ρ‚ΠΈΠ»ΡŒ: 4%
0.00145
Низкий

5.5 Medium

CVSS3

4.6 Medium

CVSS2

БвязанныС уязвимости

CVSS3: 5.5
ubuntu
12 мСсяцСв Π½Π°Π·Π°Π΄

In the Linux kernel, the following vulnerability has been resolved: net: phy: Don't register LEDs for genphy If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock: rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock() There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic. Generic PHYs do not support LEDs anyway, so don't bother registering them.

CVSS3: 5.5
redhat
12 мСсяцСв Π½Π°Π·Π°Π΄

In the Linux kernel, the following vulnerability has been resolved: net: phy: Don't register LEDs for genphy If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock: rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock() There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic. Generic PHYs do not support LEDs anyway, so don't bother registering them.

CVSS3: 5.5
nvd
12 мСсяцСв Π½Π°Π·Π°Π΄

In the Linux kernel, the following vulnerability has been resolved: net: phy: Don't register LEDs for genphy If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock: rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock() There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is det

CVSS3: 5.5
msrc
11 мСсяцСв Π½Π°Π·Π°Π΄

net: phy: Don't register LEDs for genphy

CVSS3: 5.5
debian
12 мСсяцСв Π½Π°Π·Π°Π΄

In the Linux kernel, the following vulnerability has been resolved: n ...

EPSS

ΠŸΡ€ΠΎΡ†Π΅Π½Ρ‚ΠΈΠ»ΡŒ: 4%
0.00145
Низкий

5.5 Medium

CVSS3

4.6 Medium

CVSS2

Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ BDU:2025-14969