Описание
In the Linux kernel, the following vulnerability has been resolved:
uprobes: fix kernel info leak via "[uprobes]" vma
xol_add_vma() maps the uninitialized page allocated by __create_xol_area()
into userspace. On some architectures (x86) this memory is readable even
without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ,
although this doesn't really matter, debugger can read this memory anyway.
A flaw was found in the Linux kernel's uprobes subsystem. When allocating memory for user space probes, the kernel maps an uninitialized memory page into a user space virtual memory area (VMA). A local user can exploit this vulnerability to read uninitialized memory contents, resulting in an information disclosure that may expose sensitive kernel data.
Отчет
A moderate information disclosure flaw was found in the Linux kernel's uprobes subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8 and 9, the kernel in Fedora, and the kernels used by Red Hat managed OpenShift cluster offerings. When a user-space probe (uprobe) is armed, the kernel's xol_add_vma() maps an uninitialized page allocated by __create_xol_area() into a user-space virtual memory area labeled "[uprobes]". On x86, this memory is readable even without VM_READ because VM_EXEC results in the same page-table protections as VM_EXEC|VM_READ, and a debugger can read the mapping regardless of its permissions. A local user who can inspect the memory of a process with an armed user-space probe can therefore read the contents of this uninitialized page, which may contain sensitive kernel data. Red Hat rates this flaw as Moderate impact with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting that exploitation requires local access and results only in the disclosure of kernel memory contents, with no impact to integrity or availability. The NVD base score is also 5.5 (Moderate), although its vector measures availability rather than confidentiality impact, which does not match the information-disclosure nature of this flaw. Within the Red Hat portfolio, fixes were delivered for the RHEL 9.6 kernel stream and for Fedora, while fixes are not planned for the RHEL 8.10.z and RHEL 9.5.z kernel and kernel-rt streams or for the kernels in Red Hat managed OpenShift (ARO/OSD) clusters, and the RHEL 6 ELS and RHEL 7 ELS streams are out of support scope. Exposure is limited to systems where user-space probes are in use.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel | Will not fix | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Will not fix | ||
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2025:6966 | 13.05.2025 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2025:6966 | 13.05.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "[uprobes]" vma xol_add_vma() maps the uninitialized page allocated by __create_xol_area() into userspace. On some architectures (x86) this memory is readable even without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ, although this doesn't really matter, debugger can read this memory anyway.
In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "[uprobes]" vma xol_add_vma() maps the uninitialized page allocated by __create_xol_area() into userspace. On some architectures (x86) this memory is readable even without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ, although this doesn't really matter, debugger can read this memory anyway.
In the Linux kernel, the following vulnerability has been resolved: u ...
In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "[uprobes]" vma xol_add_vma() maps the uninitialized page allocated by __create_xol_area() into userspace. On some architectures (x86) this memory is readable even without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ, although this doesn't really matter, debugger can read this memory anyway.
EPSS
5.5 Medium
CVSS3