جزئیات آسیب‌پذیری
CVE-2025-38724
Linux LinuxSiemens SIMATIC CN 4100Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFPSiemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPSiemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
CVSS 3.1
9.8بحرانی
شرح رسمی (انگلیسی)
In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.8بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (Linux) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Linux | Linux | 3.17 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | d20c11d86d8f821a64eac7d6c8f296f06d935f4f ≤ v < d35ac850410966010e92f401f4e21868a9ea4d8b | CVEProject cvelistV5 (CNA) |
| Linux | Linux | d20c11d86d8f821a64eac7d6c8f296f06d935f4f ≤ v < f3aac6cf390d8b80e1d82975faf4ac61175519c0 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | d20c11d86d8f821a64eac7d6c8f296f06d935f4f ≤ v < 22f45cedf281e6171817c8a3432c44d788c550e1 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | d20c11d86d8f821a64eac7d6c8f296f06d935f4f ≤ v < d71abd1ae4e0413707cd42b10c24a11d1aa71772 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | d20c11d86d8f821a64eac7d6c8f296f06d935f4f ≤ v < 74ad36ed60df561a303a19ecef400c7096b20306 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | d20c11d86d8f821a64eac7d6c8f296f06d935f4f ≤ v < 36e83eda90e0e4ac52f259f775b40b2841f8a0a3 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | d20c11d86d8f821a64eac7d6c8f296f06d935f4f ≤ v < 571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | d20c11d86d8f821a64eac7d6c8f296f06d935f4f ≤ v < 908e4ead7f757504d8b345452730636e298cbf68 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | d20c11d86d8f821a64eac7d6c8f296f06d935f4f ≤ v < 3f252a73e81aa01660cb426735eab932e6182e8d | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC CN 4100 | v < V5.0 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | V3.1.5 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | V3.1.5 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | V3.1.5 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | V3.1.5 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | V3.1.5 ≤ v | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱۳- https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8d
- https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8b
- https://git.kernel.org/stable/c/f3aac6cf390d8b80e1d82975faf4ac61175519c0
- https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1
- https://git.kernel.org/stable/c/d71abd1ae4e0413707cd42b10c24a11d1aa71772
- https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306
- https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3
- https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1
- https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
کانال تلگرام کُلون @kolunsec_fa
تازه‌های KEV، خبرهای مهم و خلاصه‌ی روزانه
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۰۶/۱۳
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۷/۲۳
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- Linux
پیش‌بینی بهره‌برداری (EPSS)
۰٫۴٪
احتمال بهره‌برداری در ۳۰ روز
۳۵٫۱٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- —