Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - hfs验证 hfsplus_bmap_alloc 中的记录偏移如果记录偏移或长度大于 node_size则 hfsplus_bmap_alloc 可触发崩溃 [ 15.264282] BUGKASANhfsplus_bmap_alloc+0x887/0x8b0 中的 slab 越界 [ 15.265192] 的读取size 8 at addr ffff8881085ca188由 task test/183 报告 [15.265949] [ 15.266163] CPU: 0 UID: 0 PID: 183 Comm: test Not tainted 6.17.0-rc2-gc17b750b3ad9 #14 PREEMPT(optional) [ 15.266165] Hardware名称QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.266167] Call Trace[ 15.266168] <TASK> [ 15.266169] dump_stack_lvl +0x53/0x70 [ 15.266173] print_report+0xd0/0x660 [ 15.266181] kasan_report+0xce/0x100 [15.266185] hfsplus_bmap_alloc+0x887/0x8b0 [ 15.266208] hfs_btree_inc_height.isra.0+0xd5/0x7c0 [ 15.266217] hfsplus_brec_insert+ 0x870/0xb00 [ 15.266222] __hfsplus_ext_write_extent+0x428/0x570 [ 15.266225]
    __hfsplus_ext_cache_extent+0x5e/0x910 [ 15.266227] hfsplus_ext_read_extent+0x1b2/0x200 [ 15.266233] hfsplus_file_extend+0x5a7/0x1000 [ 15.266237] hfsplus_get_block+0x12b/0x8c0 [ 15.266238]
     15.266251... 15.266252​ 15.266259​ 15.266262​ 15.266270​ [ 15.266274] generic_perform_write+0x321/0x750 [ 15.266285] generic_file_write_iter+0xc3/0x310 [ 15.266289]
    __kernel_write_iter+0x2fd/0x800 [ 15.266296] dump_user_range+0x2ea/0x910 [ 15.266301] elf_core_dump+0x2a94/0x2ed0 [ 15.266320] vfs_coredump+0x1d85/0x45e0 [ 15.266349] get_signal+0x12e3/0x1990 [ 15.266357] arch_do_rex1990 [ 15.266362] irqentry_exit_to_user_mode+0xab/0x110 [15.266364] asm_exc_page_fault+0x26/0x30 [ 15.266366] RIP0033:0x41bd35 [ 15.266367] 代码bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 9f 0b 00 00 66 0f ef c0 <f3> 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d0 49 [83 f8f 15.266369RSP
    002b:00007ffc9e62d078 EFLAGS00010283 [ 15.266371] RAX: 00007ffc9e62d100 RBX: 0000000000000000 RCX
    0000000000000000 [ 15.266372] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffc9e62d100 [15.266373] RBP: 0000400000000040 R08: 00000000000000e0 R09: 0000000000000000 [ 15.266374] R10:
    0000000000000000 R110000000000000246 R120000000000000000 [ 15.266375] R130000000000000000 R14
    0000000000000000 R15: 0000400000000000 [ 15.266376] </TASK> 调用 hfsplus_bmap_alloc 以分配空闲节点时此函数首先使用 node->page 以及来自 hfs_brec_lenoff 的偏移和长度从标头节点和映射节点检索位图 `len = hfs_brec_lenoff(node, 2, &off16); off = off16; off += node->page_offset; pagep = node->page + (off >> PAGE_SHIFT); data = kmap_local_page(*pagep);
    '' 但是如果检索到的偏移或长度无效即超过 node_size则代码最终可能会访问为此节点分配的范围之外的页面。此修补程序添加了使用前对偏移和长度的正确验证从而防止越界页面访问。将 is_bnode_offset_valid 和 check_and_correct_requested_length 移动到 hfsplus_fs.h因为其他函数可能需要它们。
    (CVE-2025-40349)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2025-40349

high Nessus 插件 ID 279022

版本 1.1