Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - bpf精度バックトラッキングブックキーピングにスタック ptr レジスターを含めません。Yi Lai 氏は問題を報告しました[1]。カーネル dmesg に以下の警告が表示されます[ 60.643604] 検証バックトラッキングのバグ60.643635] 警告CPU: 10 PID 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10 [60.648428] モジュールがリンクされています bpf_testmod(OE) [ 60.650471] CPU10 UID0 PID2315 Commtest_progstaintedG OE 6.15. 0-rc4-gef11287f8289-dirty #327 PREEMPT(full) [ 60.654385] 汚染[O]=OOT_MODULE、[E]=UNSIGNED_MODULE 60.656682] ハードウェア名QEMU Standard PC (i440FX + PIIX, 1996)、BIOS rel -1.14.0-0-g155821a1990b-prebuilt.qemu.org 2014 年 4 月 1 日 [ 60.660475 ] RIP
    0010:__mark_chain_precision+0x3a6c/0x3e10 [ 60.662814] コード: 5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04 01 38 c7 c7 00048000000000 e8 c4 06 a5 ff <0f> 0b e9 46 fa ff ff 48 ... [ 60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246 [ 60.671075 ] RAX: 54d70e82dfd31900 RBX
    ffff888115b65e20 RCX: 0000000000000000 [ 60.673659RDX: 000000000000001 RSI: 000000000000000000004 RDI
    00000000ffffffff [ 60.676241] RBP: 0000000000000400 R08ffff8881f6f23bd3 R09: 1ffff1103ede477a [60.678787] R10dffffc0000000000 R11ffffed103ede477b R121818 60.681420ffff8 R138160816
     R141ffff11022b6cbc4  : 00000000fffffff2 R15: 0000000000000001 [ 60.684030] FS: 00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000 [ 60.686837] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0 [60.691623] Call Trace: [ 60.692821] <TASK> [ 60.693960] ? __pfx_verbose+0x10/0x10 [ 60.695656] ?
    __pfx_disasm_kfunc_name+0x10/0x10 [ 60.697495] check_cond_jmp_op+0x16f7/0x39b0 [ 60.699237] do_check+0x58fa/0xab10 ... 詳細な分析により、以下のように4302行に警告があることを示しています 4294 /* 静的サブプログ呼び出し命令、4295 * 現在のサブプログを終了することを意味します、4296 * r1-r5 のみが 4297 として依然としてリクエストされる可能性があります * 正確、r0 および r6 -r10 または 4298 の任意のスタックスロット * 現在のフレームは 4299 までにゼロでなければなりません */ 4300 if (bt_reg_mask(bt) & ~BPF_REGMASK_ARGS) { 4301 verbose(env, BUG regs %x\n, bt_reg_mask(bt)); 4302 WARN_ONCE(1、検証機能のバックトラックのバグ); 4303 return -EFAULT; 4304 } 以下のテストで次のパッチでも __used __naked static void __bpf_jmp_r10(void) { asm volatile (r2 = 2314885393468386424 ll; goto +0; if r2 <= r10 goto +3; if r1 >= -1835016 goto +0; r2 <= 8 goto +0; r3 <= 0 goto +0;終了; ::: __clobber_all; } SEC(?raw_tp) __naked void bpf_jmp_r10(void) { asm volatile ( r3 = 0 ll; call __bpf_jmp_r10; r0 = 0; exit; :::
    __clobber_all); } 以下は検証機能エラーのログです: 0: (18) r3 = 0x0 ; R3_w=0 2:(85) call pc+2 caller: R10=fp0 calleeframe1: R1=ctx() R3_w=0 R10=fp0 5: frame1: R1=ctx() R3_w=0 R10=fp0 。 asm volatile\ @ verify_precision.c:184 5:(18) r2 = 0x20202000256c6c78 ; frame1: R2_w=0x20202000256c6c78 7:(05) goto pc+0 8:(05) goto pc+0 8:(bd) if r2 <= r10 goto pc+3 の場合 ; frame1: R2_w=0x20202000256c6c78 R10=fp0 9: (35) if r1 >= 0xffe3fff8 goto pc+0 ; frame1: R1=ctx() 10:(b5) if r2 <= 0x8 goto pc+0 mark_precise:frame1:last_idx 10 first_idx 0 subseq_idx -1 mark_precise:frame1: regs=r2 stack= 9:(35) if r1 >= 0xffe3fff8 goto pc+0 mark_precise:frame1: 8 より前の regs=r2 stack= bd: r2 <= r10 goto pc +3 mark_preci ---truncated---CVE-2025-38279

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - bpf不將堆疊 ptr 暫存器包含在精確度回溯簿記中Yi Lai 報告了一個問題 ([1])其中核心 dmesg 中會出現下列警告[ 60.643604] 驗證器回溯錯誤 [60.643635] 警告 CPU10 PID kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10 的 2315 [60.648428] 連結於 bpf_testmod(OE) 的模組 [ 60.650471] CPU10 UID: 0 PID: 2315 Comm: test_progs 受污染的 G OE 6.15. 0-rc4-gef11287f8289-dirty #327 PREEMPT(full) [ 60.654385] 受污染[O]=OOT_MODULE、[E]=UNSIGNED_MODULE [ 60.656682] 硬體名稱QEMU Standard PC (i440FX + PIIX, 1996)BIOS rel -1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 60.660475] RIP
    0010:__mark_chain_precision+0x3a6c/0x3e10 [ 60.662814] 程式碼5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04 01 48 c7 4 c7 00 5 30 8 e8 c4 06 a5 ff <0f> 0b e9 46 fa ff ff 48 ... [ 60.668720] RSP 0018:ffff888116cc7298 EFLAGS00010246 [ 60.671075] RAX 54d70e82dfd31900 RBX
    ffff888115b65e20 RCX 0000000000000000 [ 60.673659] RDX 0000000000000001 RSI 0000000000000004 RDI
    00000000ffffffff [ 60.676241] RBP0000000000000400 R08ffff8881f6f23bd3 R091ffff1103ede477a [60.678787] R10dffffc0000000000 R11ffffed103ede477b 1] 560 [ R12]1] 560 []1] 560 60.681420R13888ae
     R141ffff11022b6cbc4  : 00000000fffffff2 R15: 0000000000000001 [ 60.684030] FS: 00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000 [ 60.686837] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 60.689027] CR2000056325369e000 CR3000000011088b002 CR40000000000370ef0 [60.691623] 呼叫追踪 [ 60.692821] <TASK> [ 60.693960] __pfx_verbose+0x10/0x10 [ 60.695656] ?
    __pfx_disasm_kfunc_name+0x10/0x10 [ 60.697495] check_cond_jmp_op+0x16f7/0x39b0 [ 60.699237] do_check+0x58fa/0xab10 ... 進一步分析顯示警告位於第 4302 行如下4294 /* 靜態 subprog 呼叫指示其中 4295 * 表示我們正在結束目前的 subprog4296 * 因此只有 r1-r5 仍可要求為 4297 * 精確的 r0 和 r6 -r10 或 4298 中的任何堆疊插槽 * 到現在為止目前框架應該是零 4299 */ 4300 if (bt_reg_mask(bt) & ~BPF_REGMASK_ARGS) { 4301 verbose(env、BUG regs %x\n、bt_reg_mask(bt)); 4302 WARN_ONCE(1驗證器回溯錯誤) 4303 傳回 -EFAULT 4304 } 透過下列測試 (也在下一個修補程式中) __used __naked static void __bpf_jmp_r10(void) { asm volatile (r2 = 2314885393468386424 ll; goto +0; if r2 <= r10 goto +3; if r1 >= -1835016 goto +0 if r2 <= 8 goto +0 if r3 <= 0 goto +0 exit::: __clobber_all) } SEC(?raw_tp) __naked void bpf_jmp_r10(void) { asm volatile ( r3 = 0 ll; call __bpf_jmp_r10; r0 = 0; exit; :::
    __clobber_all);以下是驗證程式失敗記錄 0 (18) r3 = 0x0 R3_w=0 2(85) 呼叫 pc+2 呼叫者 R10=fp0 被呼叫者frame1: R1=ctx() R3_w=0 R10=fp0 5: frame1: R1=ctx() R3_w=0 R10=fp0 ; asm volatile ( \ @ verifier_precision.c:184 5(18) r2 = 0x20202000256c6c78 frame1 R2_w=0x20202000256c6c78 7(05) goto pc+0 8(bd) 如果 r2 <= r10 goto pc+3 R2_w=0x20202000256c6c78 R10=fp0 9: (35) if r1 >= 0xffe3fff8 goto pc+0 ; frame1: R1=ctx() 10: (b5) if r2 <= 0x8 goto pc+0 mark_precision: frame1last_idx 10 first_idx 0 subseq_idx -1 mark_precision: frame1: regs=r2 stack= Before 9: (35) if r1 >= 0xffe3fff8 goto pc+0 mark_precision: frame1: regs=r2 stack= Before 8: (bd) if r2 <= r10 goto pc +3 mark_precision ---truncated--- (CVE-2025-38279)

請注意，Nessus 依賴供應商報告的套件存在。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bpf: Do not include stack ptr register in precision backtracking bookkeeping Yi Lai reported an issue     ([1]) where the following warning appears in kernel dmesg: [ 60.643604] verifier backtracking bug [     60.643635] WARNING: CPU: 10 PID: 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10 [     60.648428] Modules linked in: bpf_testmod(OE) [ 60.650471] CPU: 10 UID: 0 PID: 2315 Comm: test_progs     Tainted: G OE 6.15.0-rc4-gef11287f8289-dirty #327 PREEMPT(full) [ 60.654385] Tainted: [O]=OOT_MODULE,     [E]=UNSIGNED_MODULE [ 60.656682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 60.660475] RIP:
    0010:__mark_chain_precision+0x3a6c/0x3e10 [ 60.662814] Code: 5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8     04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04 01 48 c7 c7 00 58 30 84 e8 c4 06 a5 ff <0f> 0b e9 46 fa ff ff 48     ... [ 60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246 [ 60.671075] RAX: 54d70e82dfd31900 RBX:
    ffff888115b65e20 RCX: 0000000000000000 [ 60.673659] RDX: 0000000000000001 RSI: 0000000000000004 RDI:
    00000000ffffffff [ 60.676241] RBP: 0000000000000400 R08: ffff8881f6f23bd3 R09: 1ffff1103ede477a [     60.678787] R10: dffffc0000000000 R11: ffffed103ede477b R12: ffff888115b60ae8 [ 60.681420] R13:
    1ffff11022b6cbc4 R14: 00000000fffffff2 R15: 0000000000000001 [ 60.684030] FS: 00007fc2aedd80c0(0000)     GS:ffff88826fa8a000(0000) knlGS:0000000000000000 [ 60.686837] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0 [     60.691623] Call Trace: [ 60.692821] <TASK> [ 60.693960] ? __pfx_verbose+0x10/0x10 [ 60.695656] ?
    __pfx_disasm_kfunc_name+0x10/0x10 [ 60.697495] check_cond_jmp_op+0x16f7/0x39b0 [ 60.699237]     do_check+0x58fa/0xab10 ... Further analysis shows the warning is at line 4302 as below: 4294 /* static     subprog call instruction, which 4295 * means that we are exiting current subprog, 4296 * so only r1-r5     could be still requested as 4297 * precise, r0 and r6-r10 or any stack slot in 4298 * the current frame     should be zero by now 4299 */ 4300 if (bt_reg_mask(bt) & ~BPF_REGMASK_ARGS) { 4301 verbose(env, BUG regs     %x\n, bt_reg_mask(bt)); 4302 WARN_ONCE(1, verifier backtracking bug); 4303 return -EFAULT; 4304 } With     the below test (also in the next patch): __used __naked static void __bpf_jmp_r10(void) { asm volatile (     r2 = 2314885393468386424 ll; goto +0; if r2 <= r10 goto +3; if r1 >= -1835016 goto +0; if r2 <= 8     goto +0; if r3 <= 0 goto +0; exit; ::: __clobber_all); } SEC(?raw_tp) __naked void     bpf_jmp_r10(void) { asm volatile ( r3 = 0 ll; call __bpf_jmp_r10; r0 = 0; exit; :::
    __clobber_all); } The following is the verifier failure log: 0: (18) r3 = 0x0 ; R3_w=0 2: (85) call pc+2     caller: R10=fp0 callee: frame1: R1=ctx() R3_w=0 R10=fp0 5: frame1: R1=ctx() R3_w=0 R10=fp0 ; asm volatile     ( \ @ verifier_precision.c:184 5: (18) r2 = 0x20202000256c6c78 ; frame1: R2_w=0x20202000256c6c78 7: (05)     goto pc+0 8: (bd) if r2 <= r10 goto pc+3 ; frame1: R2_w=0x20202000256c6c78 R10=fp0 9: (35) if r1 >=     0xffe3fff8 goto pc+0 ; frame1: R1=ctx() 10: (b5) if r2 <= 0x8 goto pc+0 mark_precise: frame1: last_idx 10     first_idx 0 subseq_idx -1 mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto     pc+0 mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 goto pc+3 mark_preci ---truncated---     (CVE-2025-38279)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - bpf在精度回溯记录中不包括堆栈 ptr 寄存器 Yi Lai 报告了一个问题 ([1])其中 kernel dmesg 中出现以下警告[ 60.643604] 验证程序回溯缺陷 [60.643635] WARNINGCPU: 10 PID 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10 [60.648428] 链接的模块bpf_testmod(OE) [ 60.650471] CPU10 UID0 PID2315 Commtest_progs 感染G OE 6.15. 0-rc4-gef11287f8289-dirty #327 PREEMPT(full) [ 60.654385] 受感染[O]=OOT_MODULE, [E]=UNSIGNED_MODULE [ 60.656682] 硬件名称QEMU Standard PC (i440FX + PIIX,1996)BIOS 相关-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 60.660475] RIP
    0010:__mark_chain_precision+0x3a6c/0x3e10 [ 60.662814] Code5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04 01 48 c7 c7 30 84 e8 c4 06 a5 ff <0f> 0b e9 46 fa ff ff 48 ... [ 60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246 [ 60.671075] RAX: 54d70e82dfd31900 RBX
    ffff888115b65e20 RCX 0000000000000000 [ 60.673659] RDX: 0000000000000001 RSI: 0000000000000004 RDI:
    00000000ffffffff [ 60.676241] RBP: 0000000000000400 R08ffff8881f6f23bd3 R09: 1ffff1103ede477a [60.678787] R10dffffc0000000000 R11ffffed103ede477b R12[ 60.68142081] [ R1381ff81ff815] ffb68ae
     R141ffff11022b6cbc4  : 00000000fffffff2 R15: 0000000000000001 [ 60.684030] FS: 00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000 [ 60.686837] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0 [60.691623] 调用跟踪 [ 60.692821] <TASK> [ 60.693960] ? __pfx_verbose+0x10/0x10 [ 60.695656] ?
    __pfx_disasm_kfunc_name+0x10/0x10 [ 60.697495] check_cond_jmp_op+0x16f7/0x39b0 [ 60.699237] do_check+0x58fa/0xab10 ... 第 4294 章显示警告如下第 4302 行-r10 或 中的任何堆栈槽4298 * 当前帧现在应为零 4299 */ 4300 if (bt_reg_mask(bt) & ~BPF_REGMASK_ARGS) { 4301 verbose(env, BUG regs %x\n, bt_reg_mask(bt)); 4302 WARN_ONCE1 验证程序回溯缺陷4303 return -EFAULT 4304 } 使用以下测试同样包含在下一个修补程序中__used __naked static void __bpf_jmp_r10(void) { asm volatile (r2 = 2314885393468386424 ll; goto +0; if r2 <= r10 goto +3; if r1 >= -1835016 goto +0; if r2 <= 8 goto +0; if r3 <= 0 goto +0; exit; ::: __clobber_all); } SEC(?raw_tp) __naked void bpf_jmp_r10(void) { asm volatile ( r3 = 0 ll; call __bpf_jmp_r10; r0 = 0; exit; ::
    __clobber_all); } 以下是验证器失败日志0: (18) r3 = 0x0; R3_w=0 2(85) 调用 pc+2 调用方 R10=fp0 被调用方frame1: R1=ctx() R3_w=0 R10=fp0 5: frame1: R1=ctx() R3_w=0 R10=fp0 ; asm volatile ( \ @ verifier_precision.c:184 5(18) r2 = 0x20202000256c6c78 ; frame1R2_w=0x20202000256c6c78 7(05) goto pc+0 8(bd) 如果 r2 <= r10 则转至 pc+3 ; frame1 R2_w=0x20202000256c6c78 R10=fp0 9(35) 如果 r1 >= 0xffe3fff8 则转到 pc+0 frame1: R1=ctx() 10(b5) 如果 r2 <= 0x8 则转到 pc+0 mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1 mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto pc+0 mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 转至 pc +3 mark_preci ---truncated--- (CVE-2025-38279)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	Name	Product	Family	Published	Updated	Severity
244408	Linux Distros のパッチ未適用の脆弱性: CVE-2025-38279	Nessus	Misc.	8/6/2025	8/6/2025	high
244408	Linux Distros 未修補的弱點：CVE-2025-38279	Nessus	Misc.	8/6/2025	8/6/2025	high
244408	Linux Distros Unpatched Vulnerability : CVE-2025-38279	Nessus	Misc.	8/6/2025	8/6/2025	high
244408	Linux Distros 未修补的漏洞：CVE-2025-38279	Nessus	Misc.	8/6/2025	8/6/2025	high

Detections

Analytics

Plugins Search

high

high

high

high