Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - smb用戶端修正非線性記憶體中的 crypto 緩衝區。crypto API (透過 scatterlist API) 預期輸入緩衝區位於線性記憶體中。我們使用 cifs_sg_set_buf() 協助程式處理此問題其可將 vmalloc 的記憶體轉換至其對應頁面。但是當我們配置 aead_request 緩衝區 (smb2ops.c::crypt_message() 中的 @creq) 時會使用 kvzalloc() 執行此動作進而可能會將 aead_request->__ctx 放在 vmalloc 區域中。然後AEAD 演算法針對其私人/內部資料和作業使用 ->__ctx並針對少數位置的此類資料使用 sg_set_buf()。只要 @creq 屬於 kmalloc 區域 (小型要求) 或 vmalloc 的記憶體仍在線性範圍內此即可正常運作。工作的堆疊預設為 vmalloc (CONFIG_VMAP_STACK=y)因此若發生此情況太多工作會將基本堆疊的位址遞增到 virt_addr_valid(buf) 會失敗的程度 (sg_set_buf() 中的 BUG())。實作加密掛載上有太多平行讀取和寫入將會觸發此錯誤。若要修正此請一律改為以 kmalloc() 配置 @creq。同時中斷 kfree_sensitive() 所需要的 @sensitive_size 變數/引數。反向追踪 [ 945.272081] ------------[cut here ]------------ [ 945.272774] include/linux/scatterlist.h:209 的核心錯誤! [ 945.273520] Oops無效 opcode0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [945.274412] CPU7 UID0 PID 56 Commkworker/u33:0 Kdump 已載入 未受污染的 6.15.0-lku-11779- g8e9d6efccdd7-dirty #1 PREEMPT(vulnerable) [ 945.275736] 硬體名稱QEMU Standard PC (Q35 + ICH9, 2009)BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [ 945.276877] 工作佇列
    writeback wb_workfn (flush-cifs-2) [ 945.277457] RIP0010:crypto_gcm_init_common+0x1f9/0x220 [945.278018] 程式碼b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b [ 945.279992] RSP00 ffffc90000a27360 EFLAGS00010246 [ 945.280578] RAX 0000000000000000 RBX
    ffffc90001d85060 RCX 0000000000000030 [ 945.281376] RDX 0000000000080000 RSI 0000000000000000 RDI
    ffffc90081d85070 [ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 [945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 [ 945.283656] R13:
     R14ffff888113522948  : ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 945.285884] CR2 00007fa7ffdd31f4 CR3 000000010540d000 CR4 0000000000350ef0 [945.286683] 呼叫追踪 [ 945.286952] <TASK> [ 945.287184] crypt_message+0x33f/0xad0 [cifs] [945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] [ 945.289300] smb_send_rqst+0xa3/0x160x16 [cifs] [ 945.289944] cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ? netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210] netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250] netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103]
    __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140]
    __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] ] wb_workfn+0x300/0x490 [ 945.298472] process_one_work+0x1fe/0x590 [ 945.298949] worker_thread+0x1ce/0x3c0 [ 945.299397]
    __pfx_worker_thread+0x10/0x10 [ 945.299900] kthr ---truncated--- (CVE-2025-40052)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterlist API, expects     input buffers to be in linear memory. We handle this with the cifs_sg_set_buf() helper that converts     vmalloc'd memory to their corresponding pages. However, when we allocate our aead_request buffer (@creq in     smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly puts aead_request->__ctx in vmalloc     area. AEAD algorithm then uses ->__ctx for its private/internal data and operations, and uses sg_set_buf()     for such data on a few places. This works fine as long as @creq falls into kmalloc zone (small requests)     or vmalloc'd memory is still within linear range. Tasks' stacks are vmalloc'd by default     (CONFIG_VMAP_STACK=y), so too many tasks will increment the base stacks' addresses to a point where     virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that happens. In practice: too many parallel     reads and writes on an encrypted mount will trigger this bug. To fix this, always alloc @creq with     kmalloc() instead. Also drop the @sensitive_size variable/arguments since kfree_sensitive() doesn't need     it. Backtrace: [ 945.272081] ------------[ cut here ]------------ [ 945.272774] kernel BUG at     include/linux/scatterlist.h:209! [ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [     945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted     6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) [ 945.275736] Hardware name: QEMU Standard PC     (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [ 945.276877] Workqueue:
    writeback wb_workfn (flush-cifs-2) [ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 [     945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00     80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b     [ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246 [ 945.280578] RAX: 0000000000000000 RBX:
    ffffc90001d85060 RCX: 0000000000000030 [ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI:
    ffffc90081d85070 [ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 [     945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 [ 945.283656] R13:
    ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000)     GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 [     945.286683] Call Trace: [ 945.286952] <TASK> [ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] [     945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724]     smb3_init_transform_rq+0x277/0x300 [cifs] [ 945.289300] smb_send_rqst+0xa3/0x160 [cifs] [ 945.289944]     cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [     945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ?     netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210]     netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250]     netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] ?     find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103]
    __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140]
    __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] wb_workfn+0x300/0x490     [ 945.298472] process_one_work+0x1fe/0x590 [ 945.298949] worker_thread+0x1ce/0x3c0 [ 945.299397] ?
    __pfx_worker_thread+0x10/0x10 [ 945.299900] kthr ---truncated--- (CVE-2025-40052)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - smbclient非リニアメモリの暗号バッファを修正。crypto API は、scatterlist API を通じて、入力バッファがリニアメモリにあると想定します。vmalloc'd メモリを対応するページに変換する cifs_sg_set_buf() ヘルパーで、これを処理します。ただし、aead_request バッファsmb2ops.c::crypt_message() での @creqを割り当てるときは、kvzalloc() で行います。これにより、aed_request->__ctx が vmalloc 領域に配置される可能性があります。AEAD アルゴリズムはその後、プライベート/内部データおよび操作のために ->__ctx を使用し、いくつかの場所でそのようなデータに対して sg_set_buf() を使用します。@creq が kmalloc ゾーン小さなリクエストに入るか、vmalloc'd メモリが線形範囲内にある限り、これは問題なく動作します。タスクのスタックはデフォルトで vmalloc'dCONFIG_VMAP_STACK=yであるため、多すぎるタスクが、virt_addr_valid(buf) が失敗するポイントまでベーススタックのアドレスをインクリメントします sg_set_buf() の BUG()。実際には、暗号化されたマウントで並行する読み取りと書き込みが多すぎると、このバグがトリガーされます。これを修正するには、代わりに kmalloc() で常に @creq を割り当てます。また、@senscient_size 変数/引数は、kfree_senscient() で必要ないため、ドロップされます。Backtrace[ 945.272081] ------------[ここで変換]----------------------- [ 945.272774] include/linux/scatterlist.h:209 でのカーネルのバグ! [ 945.273520] Oops無効な opcode0000 [#1] SMP DEBUG_PALLOC NOPTI [945.274412] CPU7 UID0 PID56 通信kworker/u33:0 Kdumpロードは汚染されていない 6.15.0-lku-11779- g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) [ 945.275736] ハードウェア名QEMU Standard PCQ35 + ICH9、2009、BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [] 945.276877] ワークキュー
    writeback wb_workfnflush-cifs-2[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220945.278018] コード: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0b 48 c7 04 24 01 00 00 00 48 18b [ 945.279992RSP :ffffc90000a27360 EFLAGS: 00010246 [ 945.280578] RAX: 0000000000000000 RBX:
    fffc90001d85060 RCX: 945.281376000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    ffffc90081d85070 945.282145RBP: ffffc90001d85010 R08ffffc90001d85000 R09: 0000000000000000 [945.282898 ] R10R11ffffc90001d85090 [ R12R13: 945.28365600000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
     R14ffff888113522948  : ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0945.286683] Call Trace: [ 945.286952] <TASK> [ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] [945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] 945.289300] smb_send1rqst+0xa3/0xa3/0x0606 [cifs] [ 945.289944] cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ? netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210] netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250] netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] ? find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103]
    __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140]
    __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] wb_workfn+0x300/0x490 [ 945.298472]  、process_one_work+0x1fe/0x590 [ 945.298949]  、 worker_thread+0x1ce/0x3c0 [ 945.299397、[ ] 、?
    __pfx_worker_thread+0x10/0x10 [ 945.299900] kthr ---truncated---CVE-2025-40052]

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - smbclient修复线性内存中的 crypto 缓冲区 crypto API 通过 scatterlist API 预期输入缓冲区位于线性内存中。我们使用 cifs_sg_set_buf() 辅助函数处理此问题该函数将 vmalloc 的内存转换到其相应的页面。但是我们在分配 aead_request 缓冲区smb2ops.c::crypt_message() 中的@creq)时使用 kvzalloc() 执行此操作这可能将 aead_request->__ctx 放入 vmalloc 区域。然后，AEAD 算法对其私有/内部数据和操作使用 ->__ctx，并在少数位置针对此类数据使用 sg_set_buf()。只要 @creq 落入 kmalloc 区域小请求或 vmalloc 的内存仍在线性范围内此功能就可以正常工作。任务的堆栈会默认进行 vmalloc (CONFIG_VMAP_STACK=y)因此过多的任务会将堆栈的基址递增到 virt_addr_valid(buf) 将会失败 (sg_set_buf() 中的 BUG())。实践中加密挂载上的并行读取和写入过多将触发此缺陷。要修复此问题请始终使用 kmalloc() 代替分配 @creq。同时删除 @sensitive_size 变量/参数因为 kfree_sensitive() 不需要它。Backtrace[ 945.272081] ------------[在此剪切 ]------------ [ 945.272774] kernel BUG include/linux/scatterlist.h:209问题[ 945.273520] Oops无效的 opcode0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [945.274412] CPU7 UID0 PID56 Commkworker/u33:0 Kdump 已加载未受感染 6.15.0-lku-11779- g8e9d6efccdd7-dirty #1 PREEMPT(随意) [ 945.275736] 硬件名称QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [ 945.276877] Workqueue
    writeback wb_workfn (flush-cifs-2) [ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 [945.278018] 代码b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b [ 945.279992] RSP: 0018 :ffffc90000a27360 EFLAGS00010246 [ 945.280578] RAX: 00000000000000000 RBX
    ffffc90001d85060 RCX 0000000000000030 [ 945.281376] RDX0000000000080000 RSI0000000000000000 RDI
    ffffc90081d85070 [ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 [945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 [ 945.283656] R13:
     R14ffff888113522948  : ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 [945.286683] 调用跟踪 [ 945.286952] <TASK> [ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] [945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] [ 945.289300] smb_send_rqst+0x1603/0x1603 [cifs] [ 945.289944] cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ? netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210] netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250] netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] ? find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103]
    __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140]
    __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] wb_workfn+0x300/0x490 [ 945.298472] process_one_work+0x1fe/0x590 [ 945.298949] work_thread+0x1ce/0x3c0 [ 945.299397] ?
    __pfx_worker_thread+0x10/0x10 [ 945.299900] kthr ---truncated--- (CVE-2025-40052)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	Name	Product	Family	Published	Updated	Severity
271900	Linux Distros 未修補的弱點：CVE-2025-40052	Nessus	Misc.	10/28/2025	10/31/2025	high
271900	Linux Distros Unpatched Vulnerability : CVE-2025-40052	Nessus	Misc.	10/28/2025	10/31/2025	high
271900	Linux Distros のパッチ未適用の脆弱性: CVE-2025-40052	Nessus	Misc.	10/28/2025	10/31/2025	high
271900	Linux Distros 未修补的漏洞：CVE-2025-40052	Nessus	Misc.	10/28/2025	10/31/2025	high

Detections

Analytics

Plugins Search

high

high

high

high