Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - netappletalk修正 AARP Proxy 探查中的釋放後使用 AARP proxyprobe 常式 (aarp_proxy_probe_network) 會傳送探查、釋放 aarp_lock、進入休眠狀態然後重新取得鎖定。
    在該視窗期間到期計時器執行緒 (__aarp_expire_timer) 可移除和 kfree() 相同項目進而導致釋放後使用。爭用情形cpu 0 cpu 1 atalk_sendmsg() | atif_proxy_probe_device() aarp_send_ddp() | aarp_proxy_probe_network() mod_timer() | lock(aarp_lock) // LOCK約 200 毫秒的逾時 | alloc(aarp_entry) 然後呼叫 | proxies[hash] = aarp_entry aarp_expire_timeout() | aarp_send_probe() | unlock(aarp_lock) // UNLOCK! lock(aarp_lock) // LOCK | msleep(100); __aarp_expire_timer(&proxies[ct]) | free(aarp_entry) | unlock(aarp_lock) // UNLOCK! | | lock(aarp_lock) // LOCK | UAF aarp_entry ================================================== ================ 錯誤KASAN在 aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 中讀取 addr ffff8880123aa360 的大小為 4 task repro/13278 CPU3 UID0 PID13278 Commrepro 未受污染 6.15.2 #3 PREEMPT(full) 呼叫追踪
    <TASK> __dump_stack lib/dump_stack.c:94 [內嵌] dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [內嵌] print_report+0xc1/0x630 mm/kasan/report.c :521 kasan_report+0xca/0x100 mm/kasan/report.c:634 aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493 atif_proxy_probe_device net/appletalk/ddp.c:332 [內嵌] atif_ioctl+0xb58/0x16c0 net/ appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 sock_do_ioctl+0xdc/0x260 net/socket.c:1190 sock_ioctl+0x239/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl。 c:51 [內嵌] __do_sys_ioctl fs/ioctl.c:906 [內嵌] __se_sys_ioctl fs/ioctl.c:892 [內嵌] __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c :63 [內嵌] do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> 已分配aarp_alloc net/appletalk/aarp.c:382 [內嵌] aarp_proxy_probe_network+0xd8/0x630 net/ appletalk/aarp.c:468 atif_proxy_probe_device net/appl etalk/ddp.c:332 [內嵌] atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857 atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818 已釋放kfree+0x148/0x4d0 mm/slub.c :4841 __aarp_expire net/appletalk/aarp.c:90 [內嵌] __aarp_expire_timer net/appletalk/aarp.c:261 [內嵌] aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317 物件位於 的錯誤位址ffff8880123aa300其屬於大小為 192 的快取 kmalloc-192。錯誤位址位於已釋放的 192 位元組區域內 96 個位元組 [ffff8880123aa300, ffff8880123aa3c0) 錯誤位址ffff8880123aa200 周圍的記憶體狀態00 00 00 00 00 00 000 000000 0000000 00 00 00 00 00 ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc >ffff8880123aa300fa fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8fb fb123b380b fb fb fb fc fc fc fc fc fc fc fc ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================== ============================================== (CVE-2025-38666)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

偵測

Linux Distros 未修補的弱點：CVE-2025-38666

medium Nessus Plugin ID 260258

版本 1.7