CVE-2025-68284 (GCVE-0-2025-68284)
Vulnerability from cvelistv5 – Published: 2025-12-16 15:06 – Updated: 2026-08-05 12:10
VLAI
EPSS
VEX
Title
libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
The len field originates from untrusted network packets. Boundary
checks have been added to prevent potential out-of-bounds writes when
decrypting the connection secret or processing service tickets.
[ idryomov: changelog ]
Severity
9.8 (Critical)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 , < f22c55a20a2d9ffbbac57408d5d488cef8201e9d
(git)
Affected: 285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 , < 8dfcc56af28cffb8f25fb9be37b3acc61f2a3d09 (git) Affected: 285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 , < ccbccfba25e9aa395daaea156b5e7790910054c4 (git) Affected: 285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 , < 5ef575834ca99f719d7573cdece9df2fe2b72424 (git) Affected: 285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 , < 6920ff09bf911bc919cd7a6b7176fbdd1a6e6850 (git) Affected: 285ea34fc876aa0a2c5e65d310c4a41269e2e5f2 , < 7fce830ecd0a0256590ee37eb65a39cbad3d64fc (git) |
guessed | |
| Linux | Linux |
Affected:
5.11
Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.197 , ≤ 5.15.* (semver) Unaffected: 6.1.159 , ≤ 6.1.* (semver) Unaffected: 6.6.119 , ≤ 6.6.* (semver) Unaffected: 6.12.61 , ≤ 6.12.* (semver) Unaffected: 6.17.11 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/auth_x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f22c55a20a2d9ffbbac57408d5d488cef8201e9d",
"status": "affected",
"version": "285ea34fc876aa0a2c5e65d310c4a41269e2e5f2",
"versionType": "git"
},
{
"lessThan": "8dfcc56af28cffb8f25fb9be37b3acc61f2a3d09",
"status": "affected",
"version": "285ea34fc876aa0a2c5e65d310c4a41269e2e5f2",
"versionType": "git"
},
{
"lessThan": "ccbccfba25e9aa395daaea156b5e7790910054c4",
"status": "affected",
"version": "285ea34fc876aa0a2c5e65d310c4a41269e2e5f2",
"versionType": "git"
},
{
"lessThan": "5ef575834ca99f719d7573cdece9df2fe2b72424",
"status": "affected",
"version": "285ea34fc876aa0a2c5e65d310c4a41269e2e5f2",
"versionType": "git"
},
{
"lessThan": "6920ff09bf911bc919cd7a6b7176fbdd1a6e6850",
"status": "affected",
"version": "285ea34fc876aa0a2c5e65d310c4a41269e2e5f2",
"versionType": "git"
},
{
"lessThan": "7fce830ecd0a0256590ee37eb65a39cbad3d64fc",
"status": "affected",
"version": "285ea34fc876aa0a2c5e65d310c4a41269e2e5f2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/auth_x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.197",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.159",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.119",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.61",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.197",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.159",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.119",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.61",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.11",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds writes in handle_auth_session_key()\n\nThe len field originates from untrusted network packets. Boundary\nchecks have been added to prevent potential out-of-bounds writes when\ndecrypting the connection secret or processing service tickets.\n\n[ idryomov: changelog ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious or compromised Ceph monitor can deliver the crafted authentication reply remotely over TCP through either messenger v1 or v2.\nAC:L - The attacker controls the forged lengths and block alignment, and the in-place AES-CBC operation writes beyond the receive buffer before validating padding or magic.\nPR:N - The attacker requires no privileges or account on the affected client; a malicious configured monitor can trigger the flaw during the automatic CephX exchange.\nUI:N - An already configured CephFS or RBD client authenticates and reconnects automatically, requiring no contemporaneous user action.\nS:U - Exploitation compromises the kernel within the same host security authority and does not inherently cross a VM, IOMMU, or other scope boundary.\nC:H - The out-of-bounds kernel-memory corruption can support control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - The forged span causes an out-of-bounds in-place write into unrelated kernel memory, potentially enabling arbitrary modification and kernel code execution.\nA:H - The corruption can reliably cause a kernel oops or panic and can be retriggered by the malicious network peer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:10:38.038Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f22c55a20a2d9ffbbac57408d5d488cef8201e9d"
},
{
"url": "https://git.kernel.org/stable/c/8dfcc56af28cffb8f25fb9be37b3acc61f2a3d09"
},
{
"url": "https://git.kernel.org/stable/c/ccbccfba25e9aa395daaea156b5e7790910054c4"
},
{
"url": "https://git.kernel.org/stable/c/5ef575834ca99f719d7573cdece9df2fe2b72424"
},
{
"url": "https://git.kernel.org/stable/c/6920ff09bf911bc919cd7a6b7176fbdd1a6e6850"
},
{
"url": "https://git.kernel.org/stable/c/7fce830ecd0a0256590ee37eb65a39cbad3d64fc"
}
],
"title": "libceph: prevent potential out-of-bounds writes in handle_auth_session_key()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68284",
"datePublished": "2025-12-16T15:06:06.235Z",
"dateReserved": "2025-12-16T14:48:05.292Z",
"dateUpdated": "2026-08-05T12:10:38.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-68284",
"date": "2026-09-14",
"epss": "0.00588",
"percentile": "0.46301"
},
"microsoft_vex": {
"current_release_date": "2026-01-07T14:39:57.000Z",
"cve": "CVE-2025-68284",
"id": "msrc_CVE-2025-68284",
"initial_release_date": "2025-12-02T00:00:00.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "libceph: prevent potential out-of-bounds writes in handle_auth_session_key()",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-68284.json",
"version": "2"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-68284\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T16:16:07.190\",\"lastModified\":\"2026-07-30T06:24:36.180\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlibceph: prevent potential out-of-bounds writes in handle_auth_session_key()\\n\\nThe len field originates from untrusted network packets. Boundary\\nchecks have been added to prevent potential out-of-bounds writes when\\ndecrypting the connection secret or processing service tickets.\\n\\n[ idryomov: changelog ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ceph/auth_x.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"285ea34fc876aa0a2c5e65d310c4a41269e2e5f2\",\"lessThan\":\"f22c55a20a2d9ffbbac57408d5d488cef8201e9d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"285ea34fc876aa0a2c5e65d310c4a41269e2e5f2\",\"lessThan\":\"8dfcc56af28cffb8f25fb9be37b3acc61f2a3d09\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"285ea34fc876aa0a2c5e65d310c4a41269e2e5f2\",\"lessThan\":\"ccbccfba25e9aa395daaea156b5e7790910054c4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"285ea34fc876aa0a2c5e65d310c4a41269e2e5f2\",\"lessThan\":\"5ef575834ca99f719d7573cdece9df2fe2b72424\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"285ea34fc876aa0a2c5e65d310c4a41269e2e5f2\",\"lessThan\":\"6920ff09bf911bc919cd7a6b7176fbdd1a6e6850\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"285ea34fc876aa0a2c5e65d310c4a41269e2e5f2\",\"lessThan\":\"7fce830ecd0a0256590ee37eb65a39cbad3d64fc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ceph/auth_x.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.197\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.159\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.119\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.61\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.11\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5ef575834ca99f719d7573cdece9df2fe2b72424\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6920ff09bf911bc919cd7a6b7176fbdd1a6e6850\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7fce830ecd0a0256590ee37eb65a39cbad3d64fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8dfcc56af28cffb8f25fb9be37b3acc61f2a3d09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ccbccfba25e9aa395daaea156b5e7790910054c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f22c55a20a2d9ffbbac57408d5d488cef8201e9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-07-30T08:11:52+00:00",
"cve": "CVE-2025-68284",
"id": "CVE-2025-68284",
"initial_release_date": "2025-12-16T00:00:00+00:00",
"product_status:known_affected": "260",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: libceph: prevent potential out-of-bounds writes in handle_auth_session_key()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68284.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…