Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - calipso不调用 AF_INET sk 的 calipso 函数。 syzkaller 报告了 txopt_get() 中的一个 null-ptr-deref。
    [0] 偏移 0x70 属于 struct ipv6_pinfo 中的 struct ipv6_txoptions因此 struct ipv6_pinfo 在此为空。但是IPv6 套接字永远不会发生这种情况因为始终在 inet6_create() 中设置 inet_sk(sk)->pinet6表示该套接字不是 IPv6 套接字。根本原因是 netlbl_conn_setattr() 中缺少验证。 netlbl_conn_setattr() 根据从用户空间传递的 struct sockaddr.sa_family 切换分支。但是netlbl_conn_setattr() 不会检查地址系列是否与套接字匹配。syzkaller 必须为 IPv4 套接字上的 IPv6 地址调用了 connect()。在 tcp_v[46]_connect() 中有正确验证但系统会更早调用 security_socket_connect()。我们将验证复制到 netlbl_conn_setattr()。 [0]Oops一般保护错误可能针对非规范地址 0xdffffc000000000e0000 [#1] PREEMPT SMP KASAN NOOPTI KASAN范围 [0x0000000000000070-0x0000000000000077] CPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 未受感染 6.12.0 #1 Hardware nameQEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:txopt_get include/net/ipv6.h:390 [内联] RIP 0010代码02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00 RSP: 0018:ffff88811b8afc48 EFLAGS: 00010212 RAX: dffffc0000000000 RBX
    1ffff11023715f8a RCX: ffffffff841ab00c RDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070 RBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e R10: ffffed1023715f9d R11:
     R120000000000000003  : ffff888123075f00 R13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80 FS: 00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0 PKRU: 80000000 调用跟踪 <TASK> calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557 netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177 selinux_netlbl_socket_connect01xnethelp0x56/0x80 c:569 selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [内联] selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615 selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931 security_socket_connect+0x50/0xa0 security /security.c:4598
    __sys_connect_file+0xa4/0x190 net/socket.c:2067 __sys_connect+0x12c/0x170 net/socket.c:2088
    __do_sys_connect net/socket.c:2098 [内联] __se_sys_connect net/socket.c:2095 [内联]
    __x64_sys_connect+0x73/0xb0 net/socket.c:2095 do_syscall_x64 arch/x86/entry/common.c:52 [内联] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP
    0033:0x7f901b61a12d 代码02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 08 24 d08 24 d05 <48>  33:0x7f901b61a12d 代码01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX
    00007f901b925fa0 RCX: 00007f901b61a12d RDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003 RBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
    0000000000000246 R120000000000000000 R130000000000000000 R1400007f901b5b62a0 R1500007f9019bb7000 </TASK> 中链接的模块(CVE-2025-38147)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2025-38147

medium Nessus 插件 ID 247741

版本 1.30