GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40038 (GCVE-0-2025-40038)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07
VLAI
Title
KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM must decode and emulate to skip the instruction if the CPU doesn't provide the next RIP, and getting the instruction bytes to decode requires reading guest memory. Reading guest memory through the emulator can fault, i.e. can sleep, which is disallowed since the fastpath handlers run with IRQs disabled. BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu preempt_count: 1, expected: 0 INFO: lockdep is turned off. irq event stamp: 30580 hardirqs last enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm] hardirqs last disabled at (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0 softirqs last enabled at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 softirqs last disabled at (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE Tainted: [U]=USER Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025 Call Trace: <TASK> dump_stack_lvl+0x7d/0xb0 __might_resched+0x271/0x290 __might_fault+0x28/0x80 kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm] kvm_fetch_guest_virt+0x92/0xc0 [kvm] __do_insn_fetch_bytes+0xf3/0x1e0 [kvm] x86_decode_insn+0xd1/0x1010 [kvm] x86_emulate_instruction+0x105/0x810 [kvm] __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd] handle_fastpath_invd+0xc4/0x1a0 [kvm] vcpu_run+0x11a1/0x1db0 [kvm] kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm] kvm_vcpu_ioctl+0x578/0x6a0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x8a/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f479d57a94b </TASK> Note, this is essentially a reapply of commit 5c30e8101e8d ("KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"), but with different justification (KVM now grabs SRCU when skipping the instruction for other reasons).
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b439eb8ab578557263815ba8581d02c1b730e348 , < cd3efb93677c4b0cf76348882fb429165fee33fd (git)
Affected: b439eb8ab578557263815ba8581d02c1b730e348 , < f994e9c790ce97d3cf01af4d0a1b9add0c955aee (git)
Affected: b439eb8ab578557263815ba8581d02c1b730e348 , < da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70 (git)
Affected: b439eb8ab578557263815ba8581d02c1b730e348 , < 0910dd7c9ad45a2605c45fd2bf3d1bcac087687c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.113 , ≤ 6.6.* (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cd3efb93677c4b0cf76348882fb429165fee33fd",
              "status": "affected",
              "version": "b439eb8ab578557263815ba8581d02c1b730e348",
              "versionType": "git"
            },
            {
              "lessThan": "f994e9c790ce97d3cf01af4d0a1b9add0c955aee",
              "status": "affected",
              "version": "b439eb8ab578557263815ba8581d02c1b730e348",
              "versionType": "git"
            },
            {
              "lessThan": "da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70",
              "status": "affected",
              "version": "b439eb8ab578557263815ba8581d02c1b730e348",
              "versionType": "git"
            },
            {
              "lessThan": "0910dd7c9ad45a2605c45fd2bf3d1bcac087687c",
              "status": "affected",
              "version": "b439eb8ab578557263815ba8581d02c1b730e348",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.113",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn\u0027t valid\n\nSkip the WRMSR and HLT fastpaths in SVM\u0027s VM-Exit handler if the next RIP\nisn\u0027t valid, e.g. because KVM is running with nrips=false.  SVM must\ndecode and emulate to skip the instruction if the CPU doesn\u0027t provide the\nnext RIP, and getting the instruction bytes to decode requires reading\nguest memory.  Reading guest memory through the emulator can fault, i.e.\ncan sleep, which is disallowed since the fastpath handlers run with IRQs\ndisabled.\n\n BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106\n in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu\n preempt_count: 1, expected: 0\n INFO: lockdep is turned off.\n irq event stamp: 30580\n hardirqs last  enabled at (30579): [\u003cffffffffc08b2527\u003e] vcpu_run+0x1787/0x1db0 [kvm]\n hardirqs last disabled at (30580): [\u003cffffffffb4f62e32\u003e] __schedule+0x1e2/0xed0\n softirqs last  enabled at (30570): [\u003cffffffffb4247a64\u003e] fpu_swap_kvm_fpstate+0x44/0x210\n softirqs last disabled at (30568): [\u003cffffffffb4247a64\u003e] fpu_swap_kvm_fpstate+0x44/0x210\n CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G     U              6.16.0-smp--e6c618b51cfe-sleep #782 NONE\n Tainted: [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x7d/0xb0\n  __might_resched+0x271/0x290\n  __might_fault+0x28/0x80\n  kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]\n  kvm_fetch_guest_virt+0x92/0xc0 [kvm]\n  __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]\n  x86_decode_insn+0xd1/0x1010 [kvm]\n  x86_emulate_instruction+0x105/0x810 [kvm]\n  __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]\n  handle_fastpath_invd+0xc4/0x1a0 [kvm]\n  vcpu_run+0x11a1/0x1db0 [kvm]\n  kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]\n  kvm_vcpu_ioctl+0x578/0x6a0 [kvm]\n  __se_sys_ioctl+0x6d/0xb0\n  do_syscall_64+0x8a/0x2c0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f479d57a94b\n  \u003c/TASK\u003e\n\nNote, this is essentially a reapply of commit 5c30e8101e8d (\"KVM: SVM:\nSkip WRMSR fastpath on VM-Exit if next RIP isn\u0027t valid\"), but with\ndifferent justification (KVM now grabs SRCU when skipping the instruction\nfor other reasons)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker must execute instructions on a vCPU, i.e. run code inside a KVM guest on the host (or open /dev/kvm locally and run a minimal guest); there is no network-facing path to `svm_exit_handlers_fastpath()`. Per convention for KVM guest-to-host issues this is Local.\nAC:L - On an affected host (AMD without X86_FEATURE_NRIPS, `kvm_amd.nrips=0`, or a VMCB with `next_rip==0`) a single guest `HLT` \u2014 which every guest idle loop executes \u2014 deterministically drives `__svm_skip_emulated_instruction()` into the emulator with IRQs disabled, so the attacker can trigger it at will and repeatedly.\nPR:N - No privileges in the host\u0027s security authority are needed \u2014 an ordinary untrusted tenant VM triggers this with instructions any guest OS executes on its own, with no host credential, capability, or namespace involved.\nUI:N - The guest triggers the condition entirely on its own via a normal HLT/WRMSR VM-Exit; no host administrator or other user has to do anything.\nS:C - The vulnerable code is guest-controlled input handling in KVM, but the damage lands on the host kernel (atomic-context violation, BUG splat, potential lockup), crossing the guest/host virtualization boundary into a different security authority.\nC:N - The bug is a sleeping-in-atomic-context violation with no out-of-bounds or use-after-free access; the guest gains no read primitive, and the debug splat lands only in host dmesg which the guest cannot observe.\nI:N - No memory is corrupted and no write primitive is produced \u2014 the fetch either succeeds normally or fails with -EFAULT, and the only state change is the attacker\u0027s own guest being terminated with KVM_EXIT_INTERNAL_ERROR.\nA:H - Every guest HLT produces a host `BUG: sleeping function called from invalid context` splat (log flood, and a panic under panic_on_warn), and on CONFIG_PREEMPT_COUNT=n kernels the host actually blocks in handle_mm_fault() with hard IRQs disabled, risking deadlock/hard lockup; the failure path also spuriously kills the VM."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:11.980Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cd3efb93677c4b0cf76348882fb429165fee33fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/f994e9c790ce97d3cf01af4d0a1b9add0c955aee"
        },
        {
          "url": "https://git.kernel.org/stable/c/da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70"
        },
        {
          "url": "https://git.kernel.org/stable/c/0910dd7c9ad45a2605c45fd2bf3d1bcac087687c"
        }
      ],
      "title": "KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn\u0027t valid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40038",
    "datePublished": "2025-10-28T11:48:18.889Z",
    "dateReserved": "2025-04-16T07:20:57.153Z",
    "dateUpdated": "2026-08-05T12:07:11.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40038",
      "date": "2026-09-20",
      "epss": "0.00166",
      "percentile": "0.06236"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-29T01:01:49.000Z",
      "cve": "CVE-2025-40038",
      "id": "msrc_CVE-2025-40038",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn\u0027t valid",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40038.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/x86/kvm/svm/svm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cd3efb93677c4b0cf76348882fb429165fee33fd",
                    "status": "affected",
                    "version": "b439eb8ab578557263815ba8581d02c1b730e348",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f994e9c790ce97d3cf01af4d0a1b9add0c955aee",
                    "status": "affected",
                    "version": "b439eb8ab578557263815ba8581d02c1b730e348",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70",
                    "status": "affected",
                    "version": "b439eb8ab578557263815ba8581d02c1b730e348",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0910dd7c9ad45a2605c45fd2bf3d1bcac087687c",
                    "status": "affected",
                    "version": "b439eb8ab578557263815ba8581d02c1b730e348",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/x86/kvm/svm/svm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.5"
                  },
                  {
                    "lessThan": "6.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn\u0027t valid\n\nSkip the WRMSR and HLT fastpaths in SVM\u0027s VM-Exit handler if the next RIP\nisn\u0027t valid, e.g. because KVM is running with nrips=false.  SVM must\ndecode and emulate to skip the instruction if the CPU doesn\u0027t provide the\nnext RIP, and getting the instruction bytes to decode requires reading\nguest memory.  Reading guest memory through the emulator can fault, i.e.\ncan sleep, which is disallowed since the fastpath handlers run with IRQs\ndisabled.\n\n BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106\n in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu\n preempt_count: 1, expected: 0\n INFO: lockdep is turned off.\n irq event stamp: 30580\n hardirqs last  enabled at (30579): [\u003cffffffffc08b2527\u003e] vcpu_run+0x1787/0x1db0 [kvm]\n hardirqs last disabled at (30580): [\u003cffffffffb4f62e32\u003e] __schedule+0x1e2/0xed0\n softirqs last  enabled at (30570): [\u003cffffffffb4247a64\u003e] fpu_swap_kvm_fpstate+0x44/0x210\n softirqs last disabled at (30568): [\u003cffffffffb4247a64\u003e] fpu_swap_kvm_fpstate+0x44/0x210\n CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G     U              6.16.0-smp--e6c618b51cfe-sleep #782 NONE\n Tainted: [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x7d/0xb0\n  __might_resched+0x271/0x290\n  __might_fault+0x28/0x80\n  kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]\n  kvm_fetch_guest_virt+0x92/0xc0 [kvm]\n  __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]\n  x86_decode_insn+0xd1/0x1010 [kvm]\n  x86_emulate_instruction+0x105/0x810 [kvm]\n  __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]\n  handle_fastpath_invd+0xc4/0x1a0 [kvm]\n  vcpu_run+0x11a1/0x1db0 [kvm]\n  kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]\n  kvm_vcpu_ioctl+0x578/0x6a0 [kvm]\n  __se_sys_ioctl+0x6d/0xb0\n  do_syscall_64+0x8a/0x2c0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f479d57a94b\n  \u003c/TASK\u003e\n\nNote, this is essentially a reapply of commit 5c30e8101e8d (\"KVM: SVM:\nSkip WRMSR fastpath on VM-Exit if next RIP isn\u0027t valid\"), but with\ndifferent justification (KVM now grabs SRCU when skipping the instruction\nfor other reasons)."
          }
        ],
        "id": "CVE-2025-40038",
        "lastModified": "2026-07-30T06:24:07.030",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 4.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-10-28T12:15:37.733",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0910dd7c9ad45a2605c45fd2bf3d1bcac087687c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd3efb93677c4b0cf76348882fb429165fee33fd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f994e9c790ce97d3cf01af4d0a1b9add0c955aee"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:53:13+00:00",
      "cve": "CVE-2025-40038",
      "id": "CVE-2025-40038",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn\u0027t valid",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40038.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.