Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - hfs驗證 hfsplus_bmap_alloc 中的記錄位移如果記錄位移或長度大於 node_sizehfsplus_bmap_alloc 可能會觸發當機 [ 15.264282] 錯誤 KASANhfsplus_bmap_alloc+0x887/0x8b0 中的平台超出邊界 [ 15.265192] 的讀取大小為 8 的作業 test/183 在 addr ffff8881085ca188 [15.265949] [ 15.266163] CPU: 0 UID: 0 PID: 183 Comm: test 未受污染的 6.17.0-rc2-gc17b750b3ad9 #14 PREEMPT(自發性) [ 15.266165] 硬體名稱QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996)、BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.266167] 呼叫追踪 [ 15.266168] ] <TASK> [ 15.266169] dump_stack_lvl +0x53/0x70 [ 15.266173] print_report+0xd0/0x660 [ 15.266181] kasan_report+0xce/0x100 [15.266185] hfsplus_bmap_alloc+0x887/0x8b0 [ 15.266208] hfs_btree_inc_height.isra.0+0xd5/0x7c0 [ 15.266217] hfsplus_brec_insert+ 0x870/0xb00 [ 15.266222] __hfsplus_ext_write_extent+0x428/0x570 [ 15.266225]
    __hfsplus_ext_cache_extent+0x5e/0x910 [ 15.266227] hfsplus_ext_read_extent+0x1b2/0x200 [ 15.266233] hfsplus_file_extend+0x5a7/0x1000 [ 15.266237] hfsplus_get_block+0x12b/0x8c0 [ 15.266238]
    __block_write_begin_int+0x36b/0x12c0 [ 15.266251] block_write_begin+0x77/0x110 [ 15.266252] cont_write_begin+0x428/0x720 [ 15.266259] hfsplus_write_begin+0x51/0x100 [ 15.266262] cont_write_begin+0x272/0x720 [ 15.266270x5 /x0s_writebegin+00 [ 15.266274] generic_perform_write+0x321/0x750 [ 15.266285] generic_file_write_iter+0xc3/0x310 [ 15.266289]
    __kernel_write_iter+0x2fd/0x800 [ 15.266296] dump_user_range+0x2ea/0x910 [ 15.266301] elf_core_dump+0x2a94/0x2ed0 [ 15.266320] vfs_coredump+0x1d85/0x45e0 [ 15.266349] get_signal+0x12e3/0x1990 15.266357] archx89_signal_580_restart0 [ 15.266362] irqentry_exit_to_user_mode+0xab/0x110 [15.266364] asm_exc_page_fault+0x26/0x30 [ 15.266366] RIP 0033:0x41bd35 [ 15.266367] 程式碼bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 9f 0b 00 00 66 0f ef c0 <f3> 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d7 49 83 f []f [d0 49 83 f]f 15.2663698 RSP
    002b:00007ffc9e62d078 EFLAGS00010283 [ 15.266371] RAX00007ffc9e62d100 RBX0000000000000000 RCX
    0000000000000000 [ 15.266372] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffc9e62d100 [15.266373] RBP: 0000400000000040 R08: 00000000000000e0 R09: 0000000000000000 [ 15.266374] R10:
    0000000000000000 R110000000000000246 R120000000000000000 [ 15.266375] R130000000000000000 R14
    0000000000000000 R15: 0000400000000000 [ 15.266376] </TASK> 當呼叫 hfsplus_bmap_alloc 以配置可用節點時此函式會先擷取標頭節點的點陣圖然後再使用 node->page 搭配位移和來自 hfs_brec_lenoff 的地圖節點``` len = hfs_brec_lenoff(node, 2, &off16); off = off16; off += node->page_offset pagep = node->page + (off >> PAGE_SHIFT); data = kmap_local_page(*pagep);
    ``` 不過如果擷取的位移或長度無效 (即超過 node_size)程式碼最終可能會存取超出為此節點配置範圍的頁面。此修補程式在使用前新增了位移和長度的適當驗證防止超出邊界頁面存取。將 is_bnode_offset_valid 和 check_and_correct_requested_length 移至 hfsplus_fs.h因為其他函式可能需要這兩個項目。
    (CVE-2025-40349)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2025-40349

high Nessus Plugin ID 279022

版本 1.3