The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing The function     do_fanotify_mark() does not validate if mnt_ns_from_dentry() returns NULL before dereferencing     mntns->user_ns. This causes a NULL pointer dereference in do_fanotify_mark() if the path is not a mount     namespace object. Fix this by checking mnt_ns_from_dentry()'s return value before dereferencing it. Before     the patch $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd: 3     fanotify_mark: Operation not permitted $ unshare -Urm Fanotify fd: 3 Killed int main(void){ int ffd; ffd =     fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0); if(ffd < 0){ perror(fanotify_init);
    exit(EXIT_FAILURE); } printf(Fanotify fd: %d\n,ffd); if(fanotify_mark(ffd, FAN_MARK_ADD |     FAN_MARK_MNTNS, FAN_MNT_ATTACH, AT_FDCWD, A) < 0){ perror(fanotify_mark); exit(EXIT_FAILURE); } return     0; } After the patch $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify     fd: 3 fanotify_mark: Operation not permitted $ unshare -Urm Fanotify fd: 3 fanotify_mark: Invalid argument     [ 25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038 [ 25.695006] #PF: supervisor     read access in kernel mode [ 25.695012] #PF: error_code(0x0000) - not-present page [ 25.695017] PGD     109a30067 P4D 109a30067 PUD 142b46067 PMD 0 [ 25.695025] Oops: Oops: 0000 [#1] SMP NOPTI [ 25.695032] CPU:
    4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not tainted 6.17.0-rc4 #1 PREEMPT(lazy) [ 25.695040] Hardware     name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [     25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950 [ 25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24     48 4c 89 54 24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b 5c 24 10 <48> 8b 78 38 4c     8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28 85 c9 [ 25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS:
    00010203 [ 25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220 [ 25.695110] RDX:
    0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180 [ 25.695115] RBP: 0000000000000111 R08:
    0000000000000000 R09: 0000000000000000 [ 25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12:
    00000000004012a7 [ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0 [     25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000) knlGS:0000000000000000 [ 25.695162] CS:
    0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4:
    00000000003706f0 [ 25.695201] Call Trace: [ 25.695209] <TASK> [ 25.695215]
    __x64_sys_fanotify_mark+0x1f/0x30 [ 25.695222] do_syscall_64+0x82/0x2c0 ... (CVE-2025-40072)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - fanotify逆参照前に mnt_ns_from_dentry() の戻り値を検証します mntns->user_ns の逆参照前に mnt_ns_from_dentry() が NULL を返す場合、do_fanotify_mark() 関数は検証しません。これにより、パスがマウント名前空間オブジェクトでない場合、do_fanotify_mark() で NULL ポインターデリファレンスが発生します。mnt_ns_from_dentry() の戻り値を逆参照する前にチェックすることでこれを修正します。パッチ前 $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd3 fanotify_mark操作が許可されていません $ unshare -Urm Fanotify fd3 killed int main(void){ int ffd; ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0); if(ffd < 0){ perror(fanotify_init);
    exit(EXIT_FAILURE); } printf(Fanotify fd: %d\n,ffd); if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS, FAN_MNT_ATTACH, AT_FDCWD, A) < 0){ perror(fanotify_mark); exit(EXIT_FAILURE); } return 0; } パッチ後 $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd3 fanotify_mark操作は許可されていません $ unshare -Urm Fanotify fd3 fanotify_mark無効な引数 [ 25.694973] BUGカーネル NULL ポインターデリファレンス、アドレス: 000000000000038 [ 25.695006] #PFカーネルモードでのスーパーバイザー読み取りアクセス [ 25.695012] #PF: error_code(0x0000) - not-present page [ 25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0 25.695025] Oops Oops0000 [#1] SMP NOPTI [ 25.695032] CPU
    4 UID1000 PID1478 通信fanotify_nullpt 汚染されていない 6.17.0-rc4 #1 PREEMPT(lazy) 25.695040] ハードウェア名VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform、BIOS 6.00 11/12/ 2020 [25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950 [ 25.695066] コード: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 54 24 18 4c 89 5c 24 10 4c 19 0c 24 e8 e36193 fc ff 4c 8b 54 24 18 4c 8b 5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff 8b 4c 24 28 85 c9 25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS
    00010203 [ 25.695104] RAX: 000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220 [ 25.695110RDX:
    000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180 [ 25.695115R08RBP: 00000000000000000000000000000000000000000000000000000000000000000000
    0000000000000000 R090000000000000000 [ 25.695142] R10ffff8eb48a7d56c0 R11ffff8eb482bede00 R12
    00000000004012a7 [ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0 [25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000) knlGS:0000000000000000 [ 25.695162] CS:
    0010 DS:0000 ES:0000 CR0:0000000080050033 [ 25.695170] CR2:000000000000038 CR3:0000000136994006 CR4:
    00000000003706f0 [ 25.695201] Call Trace: [ 25.695209] <TASK> [ 25.695215]
    __x64_sys_fanotify_mark+0x1f/0x30 [ 25.695222] do_syscall_64+0x82/0x2c0 ...CVE-2025-40072]

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - fanotify在解除參照之前驗證 mnt_ns_from_dentry() 的傳回值。在解除參照 mntns->user_ns 之前mnt_ns_from_dentry() 是否傳回 NULLdo_fanotify_mark() 函式未驗證。如果路徑不是掛載命名空間物件這會在 do_fanotify_mark() 中造成 NULL 指標解除參照。透過在解除參照之前檢查 mnt_ns_from_dentry() 的傳回值來修正此問題。修補程式之前 $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd: 3 fanotify_mark: 操作不允許 $ unshare -Urm Fanotify fd: 3 終止 int main(void){ int ffd; ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0); if(ffd < 0){ perror(fanotify_init);
    exit(EXIT_FAILURE); printf(Fanotify fd: %d\n,ffd); if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS, FAN_MNT_ATTACH, AT_FDCWD, A) < 0){ perror(fanotify_mark); exit(EXIT_FAILURE);傳回 0 } 修補程式之後 $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd: 3 fanotify_mark: 不允許操作 $ unshare -Urm Fanotify fd: 3 fanotify_mark: 無效引數 [ 25.694973] 錯誤核心 NULL 指標解除參照位址0000000000000038 [ 25.695006] #PF在核心模式中監督讀取存取 [ 25.695012] #PFerror_code(0x0000) - 不存在的頁面 [ 25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0 [ 25.695025] Oops Oops0000 [#1] SMP NOPTI [ 25.695032] CPU
    4 UID1000 PID1478 通訊fanotify_nullpt 未受污染的 6.17.0-rc4 #1 PREEMPT(lazy) [ 25.695040] 硬體名稱VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform、BIOS 6.00 11/12/ 2020 [25.695049] RIP 0010:do_fanotify_mark+0x817/0x950 [ 25.695066] 程式碼04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54 24 18 4c 89 5c 24 10 4c 819 0c 24 e8 b3 fc ff 4c 8b 54 24 18 4c 8b 5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28 85 c9 [ 25.695081] RSP0018:ffffd31c469e3c08 EFLAGS
    00010203 [ 25.695104] RAX 0000000000000000 RBX 0000000001000000 RCXffff8eb48aebd220 [ 25.695110] RDX
    0000000000000000 RSI 0000000000000000 RDI ffff8eb4835e8180 [ 25.695115] RBP 0000000000000111 R08
    0000000000000000 R090000000000000000 [ 25.695142] R10ffff8eb48a7d56c0 R11ffff8eb482bede00 R12
    00000000004012a7 [ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0 [25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000) knlGS:0000000000000000 [ 25.695162] CS:
    0010 DS0000 ES0000 CR00000000080050033 [ 25.695170] CR20000000000000038 CR30000000136994006 CR4
    00000000003706f0 [ 25.695201] 呼叫追踪 [ 25.695209] <TASK> [ 25.695215]
    __x64_sys_fanotify_mark+0x1f/0x30 [ 25.695222] do_syscall_64+0x82/0x2c0 ... (CVE-2025-40072)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - fanotify在取消引用之前验证 mnt_ns_from_dentry() 的返回值。函数 do_fanotify_mark() 在取消引用 mntns->user_ns 之前不会验证 mnt_ns_from_dentry() 是否返回 NULL。如果路径不是挂载命名空间对象这将导致 do_fanotify_mark() 中发生空指针取消引用。在取消引用 mnt_ns_from_dentry() 之前可通过检查 mnt_ns_from_dentry() 的返回值来修复此问题。修补程序之前 $ gcc fanotify_nullptr.c -o fanotify_nullptr $mkdir A $ ./fanotify_nullptr Fanotify fd:3 fanotify_mark不允许操作 $ unshare -Urm Fanotify fd:3 终止 int main(void){ int ffd; } ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0); if(ffd < 0){ perror(fanotify_init);
    退出(EXIT_FAILURE); printf(Fanotify fd: %d\n,ffd); if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS, FAN_MNT_ATTACH, AT_FDCWD, A) < 0){ perror(fanotify_mark);退出(EXIT_FAILURE); return 0 } 修补程序后 $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd:3 fanotify_mark不允许操作 $ unshare -Urm Fanotify fd:3 fanotify_mark: 无效的参数 [ 25.694973] BUG内核空指针取消引用、address0000000000000038 [ 25.695006] #PF内核模式下的主管读取访问权限 [ 25.695012] #PF: error_code(0x0000) - not-present page [ 25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0 [ 25.695025] Oops :Oops: 0000 [#1] SMP NOPTI [ 25.695032] CPU
    4 UID1000 PID1478 Commfanotify_nullpt Not tainted 6.17.0-rc4 #1 PREEMPT(lazy) [ 25.695040] 硬件名称VMware, Inc. VMware Virtual Platform/440BX Desktop Reference PlatformBIOS 6.00 11/12/ 2020 [25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950 [ 25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54 24 18 4c 89 5c 24 10 4c 89 0c 24 e3 118 b3 fc ff 4c 8b 54 24 18 4c 8b 5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28 85 c9 [ 25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS
    00010203 [ 25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220 [ 25.695110] RDX:
    0000000000000000 RSI0000000000000000 RDIffff8eb4835e8180 [ 25.695115] RBP0000000000000111 R08
    0000000000000000 R090000000000000000 [ 25.695142] R10ffff8eb48a7d56c0 R11ffff8eb482bede00 R12
    00000000004012a7 [ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0 [25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000) knlGS:0000000000000000 [ 25.695162] CS:
    0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4:
    00000000003706f0 [ 25.695201] 调用跟踪[ 25.695209] <TASK> [ 25.695215]
    __x64_sys_fanotify_mark+0x1f/0x30 [ 25.695222] do_syscall_64+0x82/0x2c0 ... (CVE-2025-40072)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	Name	Product	Family	Published	Updated	Severity
271917	Linux Distros Unpatched Vulnerability : CVE-2025-40072	Nessus	Misc.	10/28/2025	11/3/2025	medium
271917	Linux Distros のパッチ未適用の脆弱性: CVE-2025-40072	Nessus	Misc.	10/28/2025	11/3/2025	medium
271917	Linux Distros 未修補的弱點：CVE-2025-40072	Nessus	Misc.	10/28/2025	11/3/2025	medium
271917	Linux Distros 未修补的漏洞：CVE-2025-40072	Nessus	Misc.	10/28/2025	11/3/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium