Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 跟踪修复 kprobe 初始化中造成空指针取消引用的争用条件 kprobe 初始化中有一个危急的争用条件可能导致空指针取消引用 和内核崩溃。
    [1135630.084782] 无法处理虚拟地址 0000710a04630000 处的内核分页请求
    [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO) [1135630.269239] pc : kprobe_perf_func+0x30/0x260 [1135630.277643] lr: kprobe_dispatcher+0x44/0x60 [1135630.286041] sp: ffffaeff4977fa40 [1135630.293441] x29 ffffaeff4977fa40 x28ffffaf015340e400 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000 [1135630.312257] x25ffffaf029ed108a8 x24: ffffaf015340e528 [1135630.321705] x297ffffc2: ffffafc2: ffffafc2: ffffaf029ed108a8 x297
    ffffaeff4977fc50 [1135630.331154] x210000000000000000 x20 ffffaeff4977fc50 [1135630.340586] x19
    ffffaf015340e400 x18: 0000000000000000 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000 [1135630.368445] x13: 0000000000000000 x12:
    0000000000000000 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000 [1135630.386411] x9 :
    0000000000000000 x8 : 0000000000000000 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000 [1135630.412545] x3 : 0000710a04630000 x2 :
    0000000000000006 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000 [1135630.429410] 调用跟踪
    [1135630.434828] kprobe_perf_func+0x30/0x260 [1135630.441661] kprobe_dispatcher+0x44/0x60 [1135630.448396] aggr_pre_handler+0x70/0xc8 [1135630.454959] kprobe_breakpoint_handler+0x140/0x1e0 [1135630.462435] brk_handler+0xbc/0xd8 [1135630.468437] do_debug_exception +0x84/0x138 [1135630.475074] el1_dbg+0x18/0x8c [1135630.480582] security_file_permission+0x0/0xd0 [1135630.487426] vfs_write+0x70/0x1c0 [1135630.493059] ksys_write+0x5c/0xc8 [1135630.498638] __arm64_sys_write+0x24/0x30 [1135630.504821el0_svc_common+0x78/0x130 [1135630.510838] el0_svc_handler+0x38/0x78 [1135630.516834] el0_svc+0x8/0x1b0 kernel/trace/trace_kprobe.c1308 0xffff3df8995039ec <kprobe_perf_func+0x2c>ldr x21[x24,#120] include/ linux/compiler.h294 0xffff3df8995039f0 <kprobe_perf_func+0x30>ldr x1[x21,x0] kernel/trace/trace_kprobe.c 1308head = this_cpu_ptr(call->perf_events); 1309if (hlist_empty(head)) 1310返回 0 crash> struct trace_event_call -o struct trace_event_call { ... [120] struct hlist_head
    *perf_events; //(call->perf_event) ... } crash> struct trace_event_call ffffaf015340e528 struct trace_event_call { ... perf_events = 0xffff0ad5fa89f088, //this value is true, but x21 = 0 ... } 争用条件分析：争用发生在 之间kprobe 激活和 perf_events 初始化CPU0 CPU1 ==== ==== perf_kprobe_init perf_trace_event_init tp_event->perf_events = list;(1) tp_event->class->reg (2) KPROBE ACTIVE Debug 异常触发 ... kprobe_dispatcher kprobe_perf_func ->tp.flags & TP_FLAG_PROFILEhead = this_cpu_ptr(call->perf_events)(3)perf_events 仍为 NULL 问题1. CPU0 执行 (1) 分配 tp_event->perf_events = list 2. CPU0 执行 (2) 启用通过 class->reg() 实现的 kprobe 功能 3. CPU1 触发并达到 kprobe_dispatcher 4. CPU1 检查 TP_FLAG_PROFILE - 条件通过步骤 2 已完成 5. CPU1 调用 kprobe_perf_func() 并在 (3) 崩溃因为 call->perf_events 仍为空CPU1 发现 kprobe 功能已启用但没有发现 perf_ev已分配 ents。添加配对读取 ---truncated--- (CVE-2025-40042)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2025-40042

medium Nessus 插件 ID 271898

版本 1.7