235 lines
13 KiB
JSON
235 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-40307",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T07:20:57.185Z",
|
|
"datePublished": "2025-12-08T00:46:32.659Z",
|
|
"dateUpdated": "2026-10-15T22:02:43.363Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-19T16:27:52.404Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: validate cluster allocation bits of the allocation bitmap\n\nsyzbot created an exfat image with cluster bits not set for the allocation\nbitmap. exfat-fs reads and uses the allocation bitmap without checking\nthis. The problem is that if the start cluster of the allocation bitmap\nis 6, cluster 6 can be allocated when creating a directory with mkdir.\nexfat zeros out this cluster in exfat_mkdir, which can delete existing\nentries. This can reallocate the allocated entries. In addition,\nthe allocation bitmap is also zeroed out, so cluster 6 can be reallocated.\nThis patch adds exfat_test_bitmap_range to validate that clusters used for\nthe allocation bitmap are correctly marked as in-use."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable code is reached by getting a crafted exFAT image mounted from a local block device, loop file, or removable medium and then issuing a local `mkdir()`; there is no network consumer of `exfat_allocate_bitmap()`.\nAC:L - The attacker fully controls the image: clearing the bitmap's own allocation bit and pointing `start_clu` at a low cluster makes `exfat_find_free_bitmap()` deterministically return that cluster on the very first allocation, so a single `mkdir` reliably zeroes the live bitmap with no race, heap shaping, or memory-layout dependency.\nPR:L - Direct `mount()` needs CAP_SYS_ADMIN, but ubiquitous privileged mount brokers (udisks2, systemd-mount, autofs, Android vold) let an unprivileged local user get an attacker-supplied exFAT volume or loop image mounted rw, after which any user with write access to the mount can run the triggering `mkdir`.\nUI:N - The attacker requests the mount through the automount broker and runs `mkdir` themselves; on a kiosk or shared workstation inserting their own exFAT stick achieves the same, with no action required from any other user or administrator.\nS:U - The corruption and its consequences are confined to the kernel and filesystem that own the mount; no VM, IOMMU, container, or other security-authority boundary is crossed.\nC:H - Once the bitmap is zeroed the allocator re-hands out clusters that are still live, so a newly created file is backed by clusters holding the root directory, other files' data, and the allocation bitmap itself — reading that file discloses their full contents, an unbounded read of co-resident data on the shared volume rather than a small bounded leak.\nI:H - This is the core defect: the kernel zeroes and overwrites in-use on-disk metadata (\"can delete existing entries\") and reallocates already-allocated clusters, so attacker-controlled file writes land directly in directory entries and in the live in-kernel allocation bitmap, giving unbounded modification of structures the filesystem subsequently trusts.\nA:H - The zeroed bitmap makes every `exfat_clear_bitmap()` fail with `-EIO`, desyncs `used_clusters` into `exfat_fs_error_ratelimit()`, and produces aliased/looping cluster chains that yield task hangs and the syzbot-reported deadlock WARNING; with `errors=panic`, `panic_on_warn`, or `panic_on_oops` this is a full panic, and the volume is left permanently unusable."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/exfat/balloc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
|
|
"lessThan": "87f827d53bd0688597bda63ae95908e2ad39bac0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
|
|
"lessThan": "67ce8034dc0278ddd88cad93d4218a945180dddd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
|
|
"lessThan": "6bc58b4c53795ab5fe00648344aa7d9d61175f90",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
|
|
"lessThan": "13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
|
|
"lessThan": "79c1587b6cda74deb0c86fc7ba194b92958c793c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/exfat/balloc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.7",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.7",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.183",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.148",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.58",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.17.8",
|
|
"lessThanOrEqual": "6.17.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "6.1.183"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "6.6.148"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "6.12.58"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "6.17.8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.7",
|
|
"versionEndExcluding": "6.18"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/87f827d53bd0688597bda63ae95908e2ad39bac0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/67ce8034dc0278ddd88cad93d4218a945180dddd"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6bc58b4c53795ab5fe00648344aa7d9d61175f90"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/13c1d24803d5b0446b3f6f0fdd67e07ac1fdc7bf"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/79c1587b6cda74deb0c86fc7ba194b92958c793c"
|
|
}
|
|
],
|
|
"title": "exfat: validate cluster allocation bits of the allocation bitmap",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2025-40307",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:59:01.153133Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T22:02:43.363Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |