Heimdall Security Logo

CVE-2025-37991

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, <=6.12.*, <=6.14.*, 2.6.12, 6.6.90, 0, 5.15.182, <2.6.12, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, <df3592e493d7f29bae4ffde9a9325de50ddf962e, <=5.10.*, 5.4.294, <=6.6.*, <6a098c51d18ec99485668da44294565c43dbc106, 6.1.138, <2a1aff3616b3b57aa4a5f8a7762cce1e82493fe6, <cf21e890f56b7d0038ddaf25224e4f4c69ecd143, <=5.4.*, <757ba4d17b868482837c566cfefca59e2296c608, 6.14.6, <ec4584495868bd465fe60a3f771915c0e7ce7951, 6.15, <=*, <=5.15.*, <de3629baf5a33af1919dec7136d643b0662e85ef, <6c639af49e9e5615a8395981eaf5943fb40acd6f, 6.12.28, 5.10.238

Description

In the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash Camm noticed that on parisc a SIGFPE exception will crash an application with a second SIGFPE in the signal handler. Dave analyzed it, and it happens because glibc uses a double-word floating-point store to atomically update function descriptors. As a result of lazy binding, we hit a floating-point store in fpe_func almost immediately. When the T bit is set, an assist exception trap occurs when when the co-processor encounters *any* floating-point instruction except for a double store of register %fr0. The latter cancels all pending traps. Let's fix this by clearing the Trap (T) bit in the FP status register before returning to the signal handler in userspace. The issue can be reproduced with this test program: root@parisc:~# cat fpe.c static void fpe_func(int sig, siginfo_t *i, void *v) { sigset_t set; sigemptyset(&set); sigaddset(&set, SIGFPE); sigprocmask(SIG_UNBLOCK, &set, NULL); printf("GOT signal %d with si_code %ld\n", sig, i->si_code); } int main() { struct sigaction action = { .sa_sigaction = fpe_func, .sa_flags = SA_RESTART|SA_SIGINFO }; sigaction(SIGFPE, &action, 0); feenableexcept(FE_OVERFLOW); return printf("%lf\n",1.7976931348623158E308*1.7976931348623158E308); } root@parisc:~# gcc fpe.c -lm root@parisc:~# ./a.out Floating point exception root@parisc:~# strace -f ./a.out execve("./a.out", ["./a.out"], 0xf9ac7034 /* 20 vars */) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0 ... rt_sigaction(SIGFPE, {sa_handler=0x1110a, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0 --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0x1078f} --- --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0xf8f21237} --- +++ killed by SIGFPE +++ Floating point exception

Gravité et risque d'exploitation

CVE-2025-37991 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.23 %, ce qui la place devant 12.6 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, <=6.12.*, <=6.14.*, 2.6.12, 6.6.90, 0, 5.15.182, <2.6.12, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, <df3592e493d7f29bae4ffde9a9325de50ddf962e, <=5.10.*, 5.4.294, <=6.6.*, <6a098c51d18ec99485668da44294565c43dbc106, 6.1.138, <2a1aff3616b3b57aa4a5f8a7762cce1e82493fe6, <cf21e890f56b7d0038ddaf25224e4f4c69ecd143, <=5.4.*, <757ba4d17b868482837c566cfefca59e2296c608, 6.14.6, <ec4584495868bd465fe60a3f771915c0e7ce7951, 6.15, <=*, <=5.15.*, <de3629baf5a33af1919dec7136d643b0662e85ef, <6c639af49e9e5615a8395981eaf5943fb40acd6f, 6.12.28, 5.10.238) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE