Vulnerability-Lookup

BDU:2025-09075

Vulnerability from fstec - Published: 12.02.2025

Title

Уязвимость реализации протокола TLS программного средства защиты конечных точек Crowdstrike Falcon, позволяющая нарушителю выполнить атаку типа «человек посередине»

Description

Уязвимость реализации протокола TLS программного средства защиты конечных точек Crowdstrike Falcon связана с отсутствием отслеживания цепочки доверия при проверке сертификата. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить атаку типа «человек посередине»

Severity ?


                    
                      AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor

CrowdStrike Holdings, Inc.

Software Name

Falcon sensor, Falcon Kubernetes Admission Controller, Falcon Container Sensor

Software Version

до 7.21.17405 (Falcon sensor), до 7.20.17308 (Falcon sensor), до 7.19.17221 (Falcon sensor), до 7.18.17131 (Falcon sensor), до 7.17.17014 (Falcon sensor), до 7.16.16909 (Falcon sensor), до 7.15.16806 (Falcon sensor), до 7.14.16705 (Falcon sensor), до 7.13.16606 (Falcon sensor), до 7.11.16410 (Falcon sensor), до 7.10.16321 (Falcon sensor), до 7.07.16209 (Falcon sensor), до 7.06.16113 (Falcon sensor), до 7.21.1904 (Falcon Kubernetes Admission Controller), до 7.20.1808 (Falcon Kubernetes Admission Controller), до 7.18.1605 (Falcon Kubernetes Admission Controller), до 7.17.1503 (Falcon Kubernetes Admission Controller), до 7.16.1403 (Falcon Kubernetes Admission Controller), до 7.14.1203 (Falcon Kubernetes Admission Controller), до 7.13.1102 (Falcon Kubernetes Admission Controller), до 7.12.1002 (Falcon Kubernetes Admission Controller), до 7.11.904 (Falcon Kubernetes Admission Controller), до 7.10.806 (Falcon Kubernetes Admission Controller), до 7.06.603 (Falcon Kubernetes Admission Controller), до 7.21.6003 (Falcon Container Sensor), до 7.20.5908 (Falcon Container Sensor), до 7.19.5807 (Falcon Container Sensor), до 7.18.5705 (Falcon Container Sensor), до 7.17.5603 (Falcon Container Sensor), до 7.16.5503 (Falcon Container Sensor), до 7.15.5403 (Falcon Container Sensor), до 7.14.5306 (Falcon Container Sensor), до 7.13.5202 (Falcon Container Sensor), до 7.12.5102 (Falcon Container Sensor), до 7.11.5003 (Falcon Container Sensor), до 7.10.4907 (Falcon Container Sensor), до 7.06.4705 (Falcon Container Sensor)

Possible Mitigations

Использование рекомендаций производителя: https://www.crowdstrike.com/security-advisories/cve-2025-1146/

Reference

https://nvd.nist.gov/vuln/detail/CVE-2025-1146 https://www.crowdstrike.com/security-advisories/cve-2025-1146/ https://vulners.com/cve/CVE-2025-1146

CWE

CWE-296

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "CrowdStrike Holdings, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 7.21.17405 (Falcon sensor), \u0434\u043e 7.20.17308 (Falcon sensor), \u0434\u043e 7.19.17221 (Falcon sensor), \u0434\u043e 7.18.17131 (Falcon sensor), \u0434\u043e 7.17.17014 (Falcon sensor), \u0434\u043e 7.16.16909 (Falcon sensor), \u0434\u043e 7.15.16806 (Falcon sensor), \u0434\u043e 7.14.16705 (Falcon sensor), \u0434\u043e 7.13.16606 (Falcon sensor), \u0434\u043e 7.11.16410 (Falcon sensor), \u0434\u043e 7.10.16321 (Falcon sensor), \u0434\u043e 7.07.16209 (Falcon sensor), \u0434\u043e 7.06.16113 (Falcon sensor), \u0434\u043e 7.21.1904 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.20.1808 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.18.1605 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.17.1503 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.16.1403 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.14.1203 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.13.1102 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.12.1002 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.11.904 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.10.806 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.06.603 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.21.6003 (Falcon Container Sensor), \u0434\u043e 7.20.5908 (Falcon Container Sensor), \u0434\u043e 7.19.5807 (Falcon Container Sensor), \u0434\u043e 7.18.5705 (Falcon Container Sensor), \u0434\u043e 7.17.5603 (Falcon Container Sensor), \u0434\u043e 7.16.5503 (Falcon Container Sensor), \u0434\u043e 7.15.5403 (Falcon Container Sensor), \u0434\u043e 7.14.5306 (Falcon Container Sensor), \u0434\u043e 7.13.5202 (Falcon Container Sensor), \u0434\u043e 7.12.5102 (Falcon Container Sensor), \u0434\u043e 7.11.5003 (Falcon Container Sensor), \u0434\u043e 7.10.4907 (Falcon Container Sensor), \u0434\u043e 7.06.4705 (Falcon Container Sensor)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.crowdstrike.com/security-advisories/cve-2025-1146/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.02.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.07.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.07.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-09075",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-1146",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Falcon sensor, Falcon Kubernetes Admission Controller, Falcon Container Sensor",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 TLS \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a Crowdstrike Falcon, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0442\u0438\u043f\u0430 \u00ab\u0447\u0435\u043b\u043e\u0432\u0435\u043a \u043f\u043e\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435\u00bb",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 (CWE-296)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 TLS \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a Crowdstrike Falcon \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0442\u0438\u043f\u0430 \u00ab\u0447\u0435\u043b\u043e\u0432\u0435\u043a \u043f\u043e\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435\u00bb",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://nvd.nist.gov/vuln/detail/CVE-2025-1146\nhttps://www.crowdstrike.com/security-advisories/cve-2025-1146/\nhttps://vulners.com/cve/CVE-2025-1146",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-296",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,6)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,1)"
}

CVE-2025-1146 (GCVE-0-2025-1146)

Vulnerability from cvelistv5 – Published: 2025-02-12 18:27 – Updated: 2025-02-12 19:40

Title

CrowdStrike Falcon Sensor for Linux TLS Issue

Summary

CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above. CrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. Windows and Mac sensors are not affected by this.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-296 - Improper Following of a Certificate's Chain of Trust

Assigner

CrowdStrike

References

URL

Tags

https://www.crowdstrike.com/security-advisories/c…

Impacted products

Vendor

Product

Version

CrowdStrike

Falcon sensor for Linux

Unaffected: 7.21.17405 (semver)
Affected: 7.20 , < 7.20.17308 (semver)
Affected: 7.19 , < 7.19.17221 (semver)
Affected: 7.18 , < 7.18.17131 (semver)
Affected: 7.17 , < 7.17.17014 (semver)
Affected: 7.16 , < 7.16.16909 (semver)
Affected: 7.15 , < 7.15.16806 (semver)
Affected: 7.14 , < 7.14.16705 (semver)
Affected: 7.13 , < 7.13.16606 (semver)
Affected: 7.11 , < 7.11.16410 (semver)
Affected: 7.10 , < 7.10.16321 (semver)
Affected: 7.07 , < 7.07.16209 (semver)
Affected: 7.06 , < 7.06.16113 (semver)

	CrowdStrike	Falcon Kubernetes Admission Controller	Unaffected: 7.21.1904 (semver) Affected: 7.20 , < 7.20.1808 (semver) Affected: 7.18 , < 7.18.1605 (semver) Affected: 7.17 , < 7.17.1503 (semver) Affected: 7.16 , < 7.16.1403 (semver) Affected: 7.14 , < 7.14.1203 (semver) Affected: 7.13 , < 7.13.1102 (semver) Affected: 7.12 , < 7.12.1002 (semver) Affected: 7.11 , < 7.11.904 (semver) Affected: 7.10 , < 7.10.806 (semver) Affected: 7.06 , < 7.06.603 (semver)
	CrowdStrike	Falcon Container Sensor	Unaffected: 7.21.6003 (semver) Affected: 7.20 , < 7.20.5908 (semver) Affected: 7.19 , < 7.19.5807 (semver) Affected: 7.18 , < 7.18.5705 (semver) Affected: 7.17 , < 7.17.5603 (semver) Affected: 7.16 , < 7.16.5503 (semver) Affected: 7.15 , < 7.15.5403 (semver) Affected: 7.14 , < 7.14.5306 (semver) Affected: 7.13 , < 7.13.5202 (semver) Affected: 7.12 , < 7.12.5102 (semver) Affected: 7.11 , < 7.11.5003 (semver) Affected: 7.10 , < 7.10.4907 (semver) Affected: 7.06 , < 7.06.4705 (semver)

Date Public ?

2025-02-12 18:27

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1146",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-12T19:40:26.132160Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:40:41.867Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "packageName": "falcon-sensor",
          "platforms": [
            "Linux"
          ],
          "product": "Falcon sensor for Linux",
          "vendor": "CrowdStrike",
          "versions": [
            {
              "status": "unaffected",
              "version": "7.21.17405",
              "versionType": "semver"
            },
            {
              "lessThan": "7.20.17308",
              "status": "affected",
              "version": "7.20",
              "versionType": "semver"
            },
            {
              "lessThan": "7.19.17221",
              "status": "affected",
              "version": "7.19",
              "versionType": "semver"
            },
            {
              "lessThan": "7.18.17131",
              "status": "affected",
              "version": "7.18",
              "versionType": "semver"
            },
            {
              "lessThan": "7.17.17014",
              "status": "affected",
              "version": "7.17",
              "versionType": "semver"
            },
            {
              "lessThan": "7.16.16909",
              "status": "affected",
              "version": "7.16",
              "versionType": "semver"
            },
            {
              "lessThan": "7.15.16806",
              "status": "affected",
              "version": "7.15",
              "versionType": "semver"
            },
            {
              "lessThan": "7.14.16705",
              "status": "affected",
              "version": "7.14",
              "versionType": "semver"
            },
            {
              "lessThan": "7.13.16606",
              "status": "affected",
              "version": "7.13",
              "versionType": "semver"
            },
            {
              "lessThan": "7.11.16410",
              "status": "affected",
              "version": "7.11",
              "versionType": "semver"
            },
            {
              "lessThan": "7.10.16321",
              "status": "affected",
              "version": "7.10",
              "versionType": "semver"
            },
            {
              "lessThan": "7.07.16209",
              "status": "affected",
              "version": "7.07",
              "versionType": "semver"
            },
            {
              "lessThan": "7.06.16113",
              "status": "affected",
              "version": "7.06",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "Falcon Kubernetes Admission Controller",
          "vendor": "CrowdStrike",
          "versions": [
            {
              "status": "unaffected",
              "version": "7.21.1904",
              "versionType": "semver"
            },
            {
              "lessThan": "7.20.1808",
              "status": "affected",
              "version": "7.20",
              "versionType": "semver"
            },
            {
              "lessThan": "7.18.1605",
              "status": "affected",
              "version": "7.18",
              "versionType": "semver"
            },
            {
              "lessThan": "7.17.1503",
              "status": "affected",
              "version": "7.17",
              "versionType": "semver"
            },
            {
              "lessThan": "7.16.1403",
              "status": "affected",
              "version": "7.16",
              "versionType": "semver"
            },
            {
              "lessThan": "7.14.1203",
              "status": "affected",
              "version": "7.14",
              "versionType": "semver"
            },
            {
              "lessThan": "7.13.1102",
              "status": "affected",
              "version": "7.13",
              "versionType": "semver"
            },
            {
              "lessThan": "7.12.1002",
              "status": "affected",
              "version": "7.12",
              "versionType": "semver"
            },
            {
              "lessThan": "7.11.904",
              "status": "affected",
              "version": "7.11",
              "versionType": "semver"
            },
            {
              "lessThan": "7.10.806",
              "status": "affected",
              "version": "7.10",
              "versionType": "semver"
            },
            {
              "lessThan": "7.06.603",
              "status": "affected",
              "version": "7.06",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "Falcon Container Sensor",
          "vendor": "CrowdStrike",
          "versions": [
            {
              "status": "unaffected",
              "version": "7.21.6003",
              "versionType": "semver"
            },
            {
              "lessThan": "7.20.5908",
              "status": "affected",
              "version": "7.20",
              "versionType": "semver"
            },
            {
              "lessThan": "7.19.5807",
              "status": "affected",
              "version": "7.19",
              "versionType": "semver"
            },
            {
              "lessThan": "7.18.5705",
              "status": "affected",
              "version": "7.18",
              "versionType": "semver"
            },
            {
              "lessThan": "7.17.5603",
              "status": "affected",
              "version": "7.17",
              "versionType": "semver"
            },
            {
              "lessThan": "7.16.5503",
              "status": "affected",
              "version": "7.16",
              "versionType": "semver"
            },
            {
              "lessThan": "7.15.5403",
              "status": "affected",
              "version": "7.15",
              "versionType": "semver"
            },
            {
              "lessThan": "7.14.5306",
              "status": "affected",
              "version": "7.14",
              "versionType": "semver"
            },
            {
              "lessThan": "7.13.5202",
              "status": "affected",
              "version": "7.13",
              "versionType": "semver"
            },
            {
              "lessThan": "7.12.5102",
              "status": "affected",
              "version": "7.12",
              "versionType": "semver"
            },
            {
              "lessThan": "7.11.5003",
              "status": "affected",
              "version": "7.11",
              "versionType": "semver"
            },
            {
              "lessThan": "7.10.4907",
              "status": "affected",
              "version": "7.10",
              "versionType": "semver"
            },
            {
              "lessThan": "7.06.4705",
              "status": "affected",
              "version": "7.06",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.20.17308",
                  "versionStartIncluding": "7.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.19.17221",
                  "versionStartIncluding": "7.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.18.17131",
                  "versionStartIncluding": "7.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.17.17014",
                  "versionStartIncluding": "7.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.16.16909",
                  "versionStartIncluding": "7.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.15.16806",
                  "versionStartIncluding": "7.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.14.16705",
                  "versionStartIncluding": "7.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.13.16606",
                  "versionStartIncluding": "7.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.11.16410",
                  "versionStartIncluding": "7.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.10.16321",
                  "versionStartIncluding": "7.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.07.16209",
                  "versionStartIncluding": "7.07",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.06.16113",
                  "versionStartIncluding": "7.06",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "datePublic": "2025-02-12T18:27:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above.\u003cbr\u003e\u003cbr\u003e \u003cbr\u003eCrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. \u003cbr\u003e\u003cbr\u003e\u003cbr\u003eWindows and Mac sensors are not affected by this.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above.\n\n \nCrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. \n\n\nWindows and Mac sensors are not affected by this."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-296",
              "description": "CWE-296: Improper Following of a Certificate\u0027s Chain of Trust",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-12T18:48:50.205Z",
        "orgId": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
        "shortName": "CrowdStrike"
      },
      "references": [
        {
          "url": "https://www.crowdstrike.com/security-advisories/cve-2025-1146/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CrowdStrike Falcon Sensor for Linux TLS Issue",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
    "assignerShortName": "CrowdStrike",
    "cveId": "CVE-2025-1146",
    "datePublished": "2025-02-12T18:27:35.458Z",
    "dateReserved": "2025-02-10T03:03:51.392Z",
    "dateUpdated": "2025-02-12T19:40:41.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2025-09075

CVE-2025-1146 (GCVE-0-2025-1146)

Tags

Sightings

Nomenclature