586 lines
27 KiB
JSON
586 lines
27 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-40300",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T07:20:57.185Z",
|
|
"datePublished": "2025-09-11T16:49:24.809Z",
|
|
"dateUpdated": "2026-11-10T12:37:49.122Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-05-23T16:02:01.395Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/vmscape: Add conditional IBPB mitigation\n\nVMSCAPE is a vulnerability that exploits insufficient branch predictor\nisolation between a guest and a userspace hypervisor (like QEMU). Existing\nmitigations already protect kernel/KVM from a malicious guest. Userspace\ncan additionally be protected by flushing the branch predictors after a\nVMexit.\n\nSince it is the userspace that consumes the poisoned branch predictors,\nconditionally issue an IBPB after a VMexit and before returning to\nuserspace. Workloads that frequently switch between hypervisor and\nuserspace will incur the most overhead from the new IBPB.\n\nThis new IBPB is not integrated with the existing IBPB sites. For\ninstance, a task can use the existing speculation control prctl() to\nget an IBPB at context switch time. With this implementation, the\nIBPB is doubled up: one at context switch and another before running\nuserspace.\n\nThe intent is to integrate and optimize these cases post-embargo.\n\n[ dhansen: elaborate on suboptimal IBPB solution ]"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"arch/x86/include/asm/cpufeatures.h",
|
|
"arch/x86/include/asm/entry-common.h",
|
|
"arch/x86/include/asm/nospec-branch.h",
|
|
"arch/x86/kernel/cpu/bugs.c",
|
|
"arch/x86/kvm/x86.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "ac60717f9a8d21c58617d0b34274babf24135835",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "c08192b5d6730a914dee6175bc71092ee6a65f14",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "d5490dfa35427a2967e00a4c7a1b95fdbc8ede34",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "2f4f2f8f860cb4c3336a7435ebe8dcfded0c9c6e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "15006289e5c38b2a830e1fba221977a27598176c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "893387c18612bb452336a5881da0d015a7e8f4a2",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "f866eef8d1c65504d30923c3f14082ad294d0e6d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "34e5667041050711a947e260fc9ebebe08bddee5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "d7ddc93392e4a7ffcccc86edf6ef3e64c778db52",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "459274c77b37ac63b78c928b4b4e748d1f9d05c8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "510603f504796c3535f67f55fb0b124a303b44c8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "9c23a90648e831d611152ac08dbcd1283d405e7f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "15d45071523d89b3fb7372e2135fbd72f6af9506",
|
|
"lessThan": "2f8f173413f1cbf52660d04df92d0069c4306d25",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c51f1e5f57cca88d8d5894b6fad1638f643a99d0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4b3870c343a82cd2df7192cc5149c87205dcc611",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "3.16.57",
|
|
"lessThan": "3.17",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.4.168",
|
|
"lessThan": "4.5",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"arch/x86/include/asm/cpufeatures.h",
|
|
"arch/x86/include/asm/entry-common.h",
|
|
"arch/x86/include/asm/nospec-branch.h",
|
|
"arch/x86/kernel/cpu/bugs.c",
|
|
"arch/x86/kvm/x86.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.16",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.16",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.244",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.193",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.152",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.106",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.47",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.16.7",
|
|
"lessThanOrEqual": "6.16.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.17",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "5.10.244"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "5.10.244"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "5.15.193"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "5.15.193"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "6.1.152"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "6.1.152"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "6.6.106"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "6.6.106"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "6.12.47"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "6.12.47"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "6.16.7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "6.16.7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.16",
|
|
"versionEndExcluding": "6.17"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.16.57"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.4.168"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ac60717f9a8d21c58617d0b34274babf24135835"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c08192b5d6730a914dee6175bc71092ee6a65f14"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d5490dfa35427a2967e00a4c7a1b95fdbc8ede34"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2f4f2f8f860cb4c3336a7435ebe8dcfded0c9c6e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/15006289e5c38b2a830e1fba221977a27598176c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/893387c18612bb452336a5881da0d015a7e8f4a2"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f866eef8d1c65504d30923c3f14082ad294d0e6d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/34e5667041050711a947e260fc9ebebe08bddee5"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d7ddc93392e4a7ffcccc86edf6ef3e64c778db52"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/459274c77b37ac63b78c928b4b4e748d1f9d05c8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/510603f504796c3535f67f55fb0b124a303b44c8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9c23a90648e831d611152ac08dbcd1283d405e7f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2f8f173413f1cbf52660d04df92d0069c4306d25"
|
|
}
|
|
],
|
|
"title": "x86/vmscape: Add conditional IBPB mitigation",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
|
|
},
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
|
|
},
|
|
{
|
|
"url": "http://www.openwall.com/lists/oss-security/2025/11/14/3"
|
|
},
|
|
{
|
|
"url": "http://www.openwall.com/lists/oss-security/2025/11/14/4"
|
|
},
|
|
{
|
|
"url": "http://www.openwall.com/lists/oss-security/2025/11/14/6"
|
|
},
|
|
{
|
|
"url": "http://www.openwall.com/lists/oss-security/2025/11/17/2"
|
|
},
|
|
{
|
|
"url": "http://www.openwall.com/lists/oss-security/2025/11/17/3"
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2025-11-17T16:05:33.433Z"
|
|
}
|
|
},
|
|
{
|
|
"x_adpType": "supplier",
|
|
"providerMetadata": {
|
|
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
|
|
"shortName": "siemens-SADP",
|
|
"dateUpdated": "2026-11-10T12:37:49.122Z"
|
|
},
|
|
"affected": [
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC CN 4100",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "0",
|
|
"lessThan": "V5.0",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.6",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.7",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.6",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.7",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.6",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.7",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.6",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.7",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.6",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
},
|
|
{
|
|
"vendor": "Siemens",
|
|
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)",
|
|
"versions": [
|
|
{
|
|
"status": "affected",
|
|
"version": "V3.1.7",
|
|
"lessThan": "*",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "unknown"
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
|
|
},
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
|
|
},
|
|
{
|
|
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2025-40300",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-06-10T20:41:37.391418Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-06-11T18:44:14.417Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |