602 lines
29 KiB
JSON
602 lines
29 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2025-38614",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-04-16T04:51:24.029Z",
|
||
"datePublished": "2025-08-19T17:03:56.348Z",
|
||
"dateUpdated": "2026-11-10T12:36:28.442Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T12:03:29.308Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: Fix semi-unbounded recursion\n\nEnsure that epoll instances can never form a graph deeper than\nEP_MAX_NESTS+1 links.\n\nCurrently, ep_loop_check_proc() ensures that the graph is loop-free and\ndoes some recursion depth checks, but those recursion depth checks don't\nlimit the depth of the resulting tree for two reasons:\n\n - They don't look upwards in the tree.\n - If there are multiple downwards paths of different lengths, only one of\n the paths is actually considered for the depth check since commit\n 28d82dc1c4ed (\"epoll: limit paths\").\n\nEssentially, the current recursion depth check in ep_loop_check_proc() just\nserves to prevent it from recursing too deeply while checking for loops.\n\nA more thorough check is done in reverse_path_check() after the new graph\nedge has already been created; this checks, among other things, that no\npaths going upwards from any non-epoll file with a length of more than 5\nedges exist. However, this check does not apply to non-epoll files.\n\nAs a result, it is possible to recurse to a depth of at least roughly 500,\ntested on v6.15. (I am unsure if deeper recursion is possible; and this may\nhave changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion\nproblem\").)\n\nTo fix it:\n\n1. In ep_loop_check_proc(), note the subtree depth of each visited node,\nand use subtree depths for the total depth calculation even when a subtree\nhas already been visited.\n2. Add ep_get_upwards_depth_proc() for similarly determining the maximum\ndepth of an upwards walk.\n3. In ep_loop_check(), use these values to limit the total path length\nbetween epoll nodes to EP_MAX_NESTS edges."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The vulnerability is reached exclusively through the local epoll syscall interface (epoll_create/epoll_ctl/epoll_wait); there is no network-reachable path to build or trigger the nested epoll graph.\nAC:L - The attacker fully controls construction of the deep epoll chain via EPOLL_CTL_ADD and deterministically triggers the recursive walk; no race or uncontrolled condition is involved.\nPR:L - Any unprivileged local user can create and nest epoll instances and invoke poll/epoll_wait — no capabilities, root, or namespaces are required.\nUI:N - The attacker performs every step (nesting the fds and triggering the recursion) alone; no victim action is needed.\nS:U - The stack overflow corrupts kernel memory within the same security authority (the kernel); it does not cross a VM/IOMMU/sandbox boundary.\nC:H - On configs without VMAP_STACK guard pages (32-bit ARM, embedded, older kernels in the affected range), the recursion overflows the kernel stack into adjacent kernel memory, a corruption that can be leveraged to disclose kernel memory.\nI:H - The kernel-stack overflow overwrites adjacent kernel structures (historically thread_info/addr_limit), providing a memory-corruption primitive that can be steered toward control-flow hijack and arbitrary write.\nA:H - The semi-unbounded recursion reliably exhausts the 8–16KB kernel stack, causing a guard-page panic or oops and taking down the entire system."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/eventpoll.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e",
|
||
"lessThan": "71379495ab70eaba19224bd71b5b9b399eb85e04",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e",
|
||
"lessThan": "1b13b033062824495554e836a1ff5f85ccf6b039",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e",
|
||
"lessThan": "2a0c0c974bea9619c6f41794775ae4b97530e0e6",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e",
|
||
"lessThan": "7a2125962c42d5336ca0495a9ce4cb38a63e9161",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e",
|
||
"lessThan": "ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e",
|
||
"lessThan": "3542c90797bc3ab83ebab54b737d751cf3682036",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e",
|
||
"lessThan": "f2e467a48287c868818085aa35389a224d226732",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "8216e1a0d47cae06a75c42346f19dffe14e42d57",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "28a92748aa4bc57d35e7b079498b0ac2e7610a37",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "7eebcd4792c5a341559aed327b6afecbb1c46402",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "0eccd188cfeaf857a26f2d72941d27d298cf6a54",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "a72affdbb09f3f24f64ffcbbdf62c2e57c58f379",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "2.6.32.30",
|
||
"lessThan": "2.6.33",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "2.6.33.8",
|
||
"lessThan": "2.6.34",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "2.6.34.10",
|
||
"lessThan": "2.6.35",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "2.6.35.12",
|
||
"lessThan": "2.6.36",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "2.6.37.3",
|
||
"lessThan": "2.6.38",
|
||
"status": "affected",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"fs/eventpoll.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "2.6.38",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "2.6.38",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.190",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.149",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.6.103",
|
||
"lessThanOrEqual": "6.6.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.12.43",
|
||
"lessThanOrEqual": "6.12.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.15.11",
|
||
"lessThanOrEqual": "6.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.16.1",
|
||
"lessThanOrEqual": "6.16.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.17",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.38",
|
||
"versionEndExcluding": "5.15.190"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.38",
|
||
"versionEndExcluding": "6.1.149"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.38",
|
||
"versionEndExcluding": "6.6.103"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.38",
|
||
"versionEndExcluding": "6.12.43"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.38",
|
||
"versionEndExcluding": "6.15.11"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.38",
|
||
"versionEndExcluding": "6.16.1"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.38",
|
||
"versionEndExcluding": "6.17"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.32.30"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.33.8"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.34.10"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.35.12"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "2.6.37.3"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/71379495ab70eaba19224bd71b5b9b399eb85e04"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/1b13b033062824495554e836a1ff5f85ccf6b039"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/2a0c0c974bea9619c6f41794775ae4b97530e0e6"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/7a2125962c42d5336ca0495a9ce4cb38a63e9161"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/3542c90797bc3ab83ebab54b737d751cf3682036"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f2e467a48287c868818085aa35389a224d226732"
|
||
}
|
||
],
|
||
"title": "eventpoll: Fix semi-unbounded recursion",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2025-11-03T17:40:26.593Z"
|
||
}
|
||
},
|
||
{
|
||
"x_adpType": "supplier",
|
||
"providerMetadata": {
|
||
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
|
||
"shortName": "siemens-SADP",
|
||
"dateUpdated": "2026-11-10T12:36:28.442Z"
|
||
},
|
||
"affected": [
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC CN 4100",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "0",
|
||
"lessThan": "V5.0",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.5",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.6",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.7",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.5",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.6",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.7",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.5",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.6",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.7",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.5",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.6",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.7",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.5",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.6",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
},
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "V3.1.7",
|
||
"lessThan": "*",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
|
||
},
|
||
{
|
||
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
|
||
},
|
||
{
|
||
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
|
||
},
|
||
{
|
||
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2025-38614",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2026-10-15T21:52:17.401249Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-10-15T22:02:26.774Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |