{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38466", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.020Z", "datePublished": "2025-07-25T15:27:48.235Z", "dateUpdated": "2026-08-05T12:02:07.957Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:07.957Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Revert to requiring CAP_SYS_ADMIN for uprobes\n\nJann reports that uprobes can be used destructively when used in the\nmiddle of an instruction. The kernel only verifies there is a valid\ninstruction at the requested offset, but due to variable instruction\nlength cannot determine if this is an instruction as seen by the\nintended execution stream.\n\nAdditionally, Mark Rutland notes that on architectures that mix data\nin the text segment (like arm64), a similar things can be done if the\ndata word is 'mistaken' for an instruction.\n\nAs such, require CAP_SYS_ADMIN for uprobes." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The attack is performed entirely through the local `perf_event_open(2)` syscall with `attr.type = perf_uprobe.type` and an attacker-supplied `uprobe_path`/`probe_offset`. No network or physical access is involved.\nAC:L - Exploitation is fully deterministic — the attacker picks the file and the byte offset, and `arch_uprobe_analyze_insn()` accepts essentially any mid-instruction offset since the x86 decoder finds a valid instruction there. There is no race to win and no dependence on memory layout the attacker cannot control.\nPR:L - The pre-fix gate is `perfmon_capable()`, i.e. CAP_PERFMON — a deliberately non-administrative, \"principle of least privilege\" observability capability routinely delegated to ordinary developers, CI runners, profiling tools (`setcap cap_perfmon+ep /usr/bin/perf`) and monitoring agents precisely so they need not be root. The essence of this flaw is that this basic, non-admin privilege confers system-wide code-modification power, so it is not the \"significant/administrative control\" that PR:H describes.\nUI:N - `register_for_each_vma()` walks the inode's i_mmap tree and patches every mm already mapping the target file, so the attacker can corrupt an already-running root daemon (via `libc.so.6`, `sshd`, `systemd`) immediately. No victim action is required.\nS:U - The vulnerable component and the impacted resources — other processes' text and data — are both managed by the same Linux kernel security authority. This is a standard local privilege escalation, not a VM/IOMMU/sandbox boundary crossing.\nC:H - Writing an attacker-chosen `0xCC` mid-instruction lets the attacker neutralize security checks or redirect control flow inside root-owned processes and setuid binaries, and `ref_ctr_offset` supplies an additional arbitrary-offset write into their mappings. This yields code execution as root and hence disclosure of arbitrary system data.\nI:H - The attacker obtains attacker-placed byte corruption at any offset of any executable or shared library system-wide (plus an arbitrary 16-bit write primitive via `__update_ref_ctr()`), with no permission check on the target file. That is direct code-integrity destruction and privilege escalation to root.\nA:H - Corrupting an instruction in a widely mapped library such as `libc.so.6` immediately crashes or wedges every process mapping it, including init/systemd and other critical daemons, resulting in system-wide denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/events/core.c" ], "versions": [ { "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "d7ef1afd5b3f43f4924326164cee5397b66abd9c", "status": "affected", "versionType": "git" }, { "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "c0aec35f861fa746ca45aa816161c74352e6ada8", "status": "affected", "versionType": "git" }, { "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "8e8bf7bc6aa6f583336c2fda280b6cea0aed5612", "status": "affected", "versionType": "git" }, { "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "183bdb89af1b5193b1d1d9316986053b15ca6fa4", "status": "affected", "versionType": "git" }, { "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "a0a8009083e569b5526c64f7d3f2a62baca95164", "status": "affected", "versionType": "git" }, { "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "d5074256b642cdeb46a70ce2f15193e766edca68", "status": "affected", "versionType": "git" }, { "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "ba677dbe77af5ffe6204e0f3f547f3ba059c6302", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/events/core.c" ], "versions": [ { "version": "5.8", "status": "affected" }, { "version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.240", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.189", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.146", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.99", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.39", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.7", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.240" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.189" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.146" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.99" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.15.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d7ef1afd5b3f43f4924326164cee5397b66abd9c" }, { "url": "https://git.kernel.org/stable/c/c0aec35f861fa746ca45aa816161c74352e6ada8" }, { "url": "https://git.kernel.org/stable/c/8e8bf7bc6aa6f583336c2fda280b6cea0aed5612" }, { "url": "https://git.kernel.org/stable/c/183bdb89af1b5193b1d1d9316986053b15ca6fa4" }, { "url": "https://git.kernel.org/stable/c/a0a8009083e569b5526c64f7d3f2a62baca95164" }, { "url": "https://git.kernel.org/stable/c/d5074256b642cdeb46a70ce2f15193e766edca68" }, { "url": "https://git.kernel.org/stable/c/ba677dbe77af5ffe6204e0f3f547f3ba059c6302" } ], "title": "perf: Revert to requiring CAP_SYS_ADMIN for uprobes", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:38:29.560Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:42:06.381Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ] } ] } }