CVE-2025-38003
Vulnérabilité élevée dans Linux (Linux)
CVSS 7.8 · Élevée
EPSS 0.3%
Linux•Linux•Versions : 5.10.130, <=6.1.*, 5.18.11, <=6.12.*, <=6.14.*, <5.15.185, 5b48f5711f1c630841ab78dcc061de902f0e37bf, 0, 6.1.141, <6d7d458c41b98a5c1670cbd36f2923c37de51cf5, 5.19, <0622846db728a5332b917c797c733e202c4620ae, <659701c0b954ccdb4a916a4ad59bbc16e726d42c, f1b4e32aca0811aa011c76e5d6cf2fa19224b386, <4.20, 6.6.93, <=5.10.*, 5.4.294, <=6.6.*, 6.14.9, <19f553a1ddf260da6570ed8f8d91a8c87f49b63a, <5.10.238, <=5.4.*, edb4baffb9483141a50fb7f7146cfe4a4c0c2db8, 85cd41070df992d3c0dfd828866fdd243d3b774a, f34f2a18e47b73e48f90a757e1f4aaa8c7d665a1, 6.12.31, 5.15.54, <1f912f8484e9c4396378c39460bbea0af681f319, <dac5e6249159ac255dad9781793dbe5908ac9ddb, 6.15, <5.19, 5.4.205, <=*, <7c9db92d5f0eadca30884af75c53d601edc512ee, fbac09a3b8890003c0c55294c00709f3ae5501bb, <5.4.294, <=5.15.*, 5.15.185, <63567ecd99a24495208dc860d50fb17440043006, 4.19.252, 5.10.238
Description
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is generated for a bcm_op which is in the process to be removed the procfs output might show unreliable data (UAF). As the removal of bcm_op's is already implemented with rcu handling this patch adds the missing rcu_read_lock() and makes sure the list entries are properly removed under rcu protection.
Gravité et risque d'exploitation
CVE-2025-38003 obtient un score CVSS de 7.8/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.28 %, ce qui la place devant 19.4 % des CVE référencées.
Que faire ?
- Vérifiez si Linux (versions 5.10.130, <=6.1.*, 5.18.11, <=6.12.*, <=6.14.*, <5.15.185, 5b48f5711f1c630841ab78dcc061de902f0e37bf, 0, 6.1.141, <6d7d458c41b98a5c1670cbd36f2923c37de51cf5, 5.19, <0622846db728a5332b917c797c733e202c4620ae, <659701c0b954ccdb4a916a4ad59bbc16e726d42c, f1b4e32aca0811aa011c76e5d6cf2fa19224b386, <4.20, 6.6.93, <=5.10.*, 5.4.294, <=6.6.*, 6.14.9, <19f553a1ddf260da6570ed8f8d91a8c87f49b63a, <5.10.238, <=5.4.*, edb4baffb9483141a50fb7f7146cfe4a4c0c2db8, 85cd41070df992d3c0dfd828866fdd243d3b774a, f34f2a18e47b73e48f90a757e1f4aaa8c7d665a1, 6.12.31, 5.15.54, <1f912f8484e9c4396378c39460bbea0af681f319, <dac5e6249159ac255dad9781793dbe5908ac9ddb, 6.15, <5.19, 5.4.205, <=*, <7c9db92d5f0eadca30884af75c53d601edc512ee, fbac09a3b8890003c0c55294c00709f3ae5501bb, <5.4.294, <=5.15.*, 5.15.185, <63567ecd99a24495208dc860d50fb17440043006, 4.19.252, 5.10.238) est présent sur votre parc.
- Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
- À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
- Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.
Références
- https://git.kernel.org/stable/c/19f553a1ddf260da6570ed8f8d91a8c87f49b63a
- https://git.kernel.org/stable/c/659701c0b954ccdb4a916a4ad59bbc16e726d42c
- https://git.kernel.org/stable/c/0622846db728a5332b917c797c733e202c4620ae
- https://git.kernel.org/stable/c/6d7d458c41b98a5c1670cbd36f2923c37de51cf5
- https://git.kernel.org/stable/c/1f912f8484e9c4396378c39460bbea0af681f319
- https://git.kernel.org/stable/c/63567ecd99a24495208dc860d50fb17440043006
- https://git.kernel.org/stable/c/7c9db92d5f0eadca30884af75c53d601edc512ee
- https://git.kernel.org/stable/c/dac5e6249159ac255dad9781793dbe5908ac9ddb