Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - atmclip修复 clip_push() 的无限递归调用。 syzbot 报告了以下错误消息。 [0] 如果多次调用 ioctl(ATMARP_MKIP)会发生这种情况。在第一次调用期间clip_mkip() 将 clip_push() 设置为 vcc->push()第二次调用时将其复制到 clip_vcc->old_push()。之后当关闭套接字时vcc_destroy_socket() 会将空 skb 传递给 clip_push()这会调用 clip_vcc->old_push()从而触发无限递归。让我们通过检查 vcc->user_back 来阻止第二个 ioctl(ATMARP_MKIP)它由第一个调用分配为 clip_vcc。另请注意我们使用 lock_sock() 是为了防止 racy 调用。 [0]
    缺陷在 ffffc9000d66fff8 命中任务堆栈保护页堆栈为 ffffc9000d670000..ffffc9000d678000oops
    堆栈保护页面0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(full) 硬件名称QEMU Standard PC (Q35 + ICH9, 2009、BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP0010:clip_push+0x5/0x720 net/atm/clip.c:191 代码e0 8f aa 8c e8 1c ad 5b fa eb ae 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <41> 57 41 56 41 55 434 55 8 83 ec 20 48 89 f3 49 89 fd 48 bd 00 RSP: 0018:ffffc9000d670000 EFLAGS: 00010246 RAX: 1ffff1100235a4a5 RBX: ffff888011ad2508 RCX: ffff8880003c0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888037f01000 RBP: dffffc0000000000 R08: ffffffff8fa104f7 R09:
     R101ffffffff1f4209e  : dffffc0000000000 R11: ffffffff8a99b300 R12: ffffffff8a99b300 R13: ffff888037f01000 R14: ffff888011ad2500 R15: ffff888037f01578 FS: 000055557ab6d500(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0 0000000080050033 CR2: ffffc9000d66fff8 CR3:
    0000000043172000 CR40000000000352ef0 调用跟踪 <TASK> clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c 200 ...
    clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 clip_push+0x6dc/0x720 net/atm/clip.c:200 vcc_destroy_socket net/atm/common.c :183 [inline] vcc_release+0x157/0x460 net/atm/common.c:205 __sock_release net/socket.c:647 [inline] sock_close+0xc0/0x240 net/socket.c:1391
    __fput+0x449/0xa70 fs/file_table.c:465 task_work_run+0x1d1/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [内联] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c 114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/ 0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP0033:0x7ff31c98e929 代码ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8 f89 8 f89 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffb5aa1f78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 0000000000012747 RCX: 00007ff31c98e929 RDX:
    0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ff31cbb7ba0 R08: 0000000000000001 R09: 0000000db5aa226f R10: 00007ff31c7ff030 R11: 0000000000000246 R12: 00007ff31cbb608c R13:
    00007ff31cbb6080 R14fffffffffffffffff R1500007fffb5aa2090 </TASK> 中链接的模块 (CVE-2025-38459)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2025-38459

medium Nessus 插件 ID 247424

版本 1.7