Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 追踪修正 kprobe 初始化中造成 NULL 指標解除參照的爭用情形。kprobe 初始化中有重大爭用情形可能會導致 NULL 指標解除參照和核心損毀。
    [1135630.084782] 無法處理虛擬位址 0000710a04630000 的核心分頁要求 ...
    [1135630.260314] pstate404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc kprobe_perf_func+0x30/0x260 [1135630.277643] lr kprobe_dispatcher+0x44/0x60 [1135630.286041] spffffaeff4977fa40 [1135630.293441] x29 ffffaeff4977fa40 x28ffffaf015340e400 [1135630.302837] x2700000000000000001135630.321705x260000000000000000 [1135630.312257] x25 ffffaf029ed108a8 x24ffffaf015340e5feff497497
    ffffaeff4977fc50 [1135630.331154] x210000000000000000 x20ffffaeff4977fc50 [1135630.340586] x19
    ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12:
    0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 :
    0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 :
    0000000000000006 [1135630.421021] x1ffffaeff4977fc50 x00000710a04630000 [1135630.429410] 呼叫追踪
    [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [1135630.468437] do_debug_except +0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821] el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0 kernel/trace/trace_kprobe.c: 1308 0xffff3df8995039ec <kprobe_perf_func+0x2c>: ldr x21、 [x24,#120] include/ linux/compiler.h: 294 0xffff3df8995039f0 <kprobe_perf_func+0x30>ldr x1、[x21,x0] kernel/trace/trace_kprobe.c 1308head = this_cpu_ptr(call->perf_events) 1309if (hlist_empty(head)) 1310傳回 0 crash> struct trace_event_call -o struct trace_event_call { ... [120] struct hlist_head
    *perf_events //(call->perf_event) ... } crash> struct trace_event_call ffffaf015340e528 struct trace_event_call { ... perf_events = 0xffff0ad5fa89f088, //此值正確但 x21 = 0 ... } 爭用情形分析kprobe 啟用和 perf_events 初始化CPU0 CPU1 ==== ==== perf_kprobe_init perf_trace_event_init tp_event->perf_events = list;(1) tp_event->class->reg (2) KPROBE ACTIVE 偵錯例外狀況觸發了 ... kprobe_dispatcher kprobe_perf_func (tk ->tp.flags & TP_FLAG_PROFILE) head = this_cpu_ptr(call->perf_events)(3) (perf_events 仍為 NULL) 問題1. CPU0 執行 (1) 指派 tp_event->perf_events = list 2. CPU0 執行 (2) 啟用kprobe 功能透過 class->reg() 3. CPU1 觸發並到達 kprobe_dispatcher 4. CPU1 檢查 TP_FLAG_PROFILE - 條件通過 (步驟 2 已完成) 5. CPU1 呼叫 kprobe_perf_func() 並在 (3) 損毀因為 call->perf_events 仍為 NULL CPU1 發現 kprobe 功能已啟用但未發現 perf_ev ents 已指派。新增配對讀取和 ---truncated--- (CVE-2025-40042)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

偵測

Linux Distros 未修補的弱點：CVE-2025-40042

medium Nessus Plugin ID 271898

版本 1.3