369 lines
18 KiB
JSON
369 lines
18 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-38393",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T04:51:24.011Z",
|
|
"datePublished": "2025-07-25T12:53:38.104Z",
|
|
"dateUpdated": "2026-10-15T01:07:11.236Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:01:32.069Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN\n\nWe found a few different systems hung up in writeback waiting on the same\npage lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in\npnfs_update_layout(), however the pnfs_layout_hdr's plh_outstanding count\nwas zero.\n\nIt seems most likely that this is another race between the waiter and waker\nsimilar to commit ed0172af5d6f (\"SUNRPC: Fix a race to wake a sync task\").\nFix it up by applying the advised barrier."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The entire waker side is driven by the remote pNFS server — CB_LAYOUTRECALL callbacks and NFS4ERR_BAD_STATEID/EXPIRED LAYOUTGET replies set NFS_LAYOUT_DRAIN, and the server controls when the LAYOUTGET reply lands and runs nfs_layoutget_end(). A hostile or compromised MDS, or an on-path attacker on a default AUTH_SYS/TCP mount, triggers the race entirely over the network.\nAC:L - The remote server can drive an unbounded stream of layout recalls and stateid-invalidating LAYOUTGET errors concurrently with the client's ongoing I/O, retrying the drain/wake cycle until the missed-wakeup window lands. The attacker controls the triggering side of the race and the retry rate, so the condition is not beyond their influence.\nPR:N - The NFS client holds no authentication requirement over the server — the client authenticates to the server, never the reverse, and under the default AUTH_SYS there is no server authentication at all. No credentials or privileges on the target system are needed.\nUI:N - Exploitation needs only normal read/writeback activity on an already-mounted pNFS filesystem (fstab, autofs, cloud NFS), which happens continuously without any victim action. No mount or file operation must be induced at exploit time.\nS:U - The lost wakeup hangs kernel tasks within the same security authority as the affected client kernel. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a missing memory barrier before wake_up_bit(); no memory is read out of bounds, freed, or exposed. No data is disclosed.\nI:N - No memory is corrupted and no data is modified — the task simply never wakes. There is no write primitive or control-flow influence.\nA:H - The waiter in pnfs_update_layout() sleeps indefinitely while holding the page lock, and other writeback tasks then block uninterruptibly on that same page lock, wedging writeback across the system as observed in production. This is a permanent hang producing hung-task watchdog splats and a panic when hung_task_panic is set."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/nfs/pnfs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "8acc3e228e1c90bd410f73597a4549e0409f22d6",
|
|
"lessThan": "08287df60bac5b008b6bcdb03053988335d3d282",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ec23a86e060cbe30b62eb2955adc97c92d80cc4c",
|
|
"lessThan": "8846fd02c98da8b79e6343a20e6071be6f372180",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "880265c77ac415090090d1fe72a188fee71cb458",
|
|
"lessThan": "e4b13885e7ef1e64e45268feef1e5f0707c47e72",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "880265c77ac415090090d1fe72a188fee71cb458",
|
|
"lessThan": "8ca65fa71024a1767a59ffbc6a6e2278af84735e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "880265c77ac415090090d1fe72a188fee71cb458",
|
|
"lessThan": "864a54c1243ed3ca60baa4bc492dede1361f4c83",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "880265c77ac415090090d1fe72a188fee71cb458",
|
|
"lessThan": "1f4da20080718f258e189a2c5f515385fa393da6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "880265c77ac415090090d1fe72a188fee71cb458",
|
|
"lessThan": "c01776287414ca43412d1319d2877cbad65444ac",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f133819e24e78f3aaaa00e9fa2b816d5f73fd172",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5.10.124",
|
|
"lessThan": "5.10.240",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.49",
|
|
"lessThan": "5.15.187",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.18.6",
|
|
"lessThan": "5.19",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/nfs/pnfs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.19",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.19",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.240",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.187",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.144",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.97",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.37",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.15.6",
|
|
"lessThanOrEqual": "6.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.16",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.10.124",
|
|
"versionEndExcluding": "5.10.240"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15.49",
|
|
"versionEndExcluding": "5.15.187"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.1.144"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.6.97"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.12.37"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.15.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.16"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.18.6"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/08287df60bac5b008b6bcdb03053988335d3d282"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8846fd02c98da8b79e6343a20e6071be6f372180"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e4b13885e7ef1e64e45268feef1e5f0707c47e72"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8ca65fa71024a1767a59ffbc6a6e2278af84735e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/864a54c1243ed3ca60baa4bc492dede1361f4c83"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1f4da20080718f258e189a2c5f515385fa393da6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c01776287414ca43412d1319d2877cbad65444ac"
|
|
}
|
|
],
|
|
"title": "NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
|
|
},
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2025-11-03T17:37:26.857Z"
|
|
}
|
|
},
|
|
{
|
|
"x_adpType": "supplier",
|
|
"providerMetadata": {
|
|
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
|
|
"shortName": "siemens-SADP",
|
|
"dateUpdated": "2026-10-15T01:07:11.236Z"
|
|
},
|
|
"affected": [
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.5",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.5",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.5",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.5",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.5",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |