CVE-2025-40019-POC

CVE-2025-40019 概念验证 CVE-2025-40019 是加密盐扇区初始化向量机制（crypto/essiv.c）中的一个漏洞，该机制对关联认证数据（AAD）长度相对于初始化向量（IV）大小的验证不足，导致越界内存访问。 此仓库中的代码仅为漏洞触发程序，但该漏洞易于利用。 KernelCTF 参赛记录 我在 kernelctf 的电子表格中发现了这个漏洞 链接。由于该漏洞没有相关的博客文章或 PoC，我决定探索 Linux 内核的加密子系统，以查明问题原因。 背景：磁盘加密理论与 ESSIV 要理解 ESSIV 的必要性，我们必须先了解数据在磁盘上的存储方式。磁盘加密（如...

CVE-2025-40019-Essiv

CVE-2025-40019-Essiv ESSIV 模块中 CVE-2025-40019 的 PoC。（漏洞利用仍在开发中） 在利用时，请注意 scatterlist（req-src 和 req-dst）具有 pagelink 成员。据我所知，pagelink 是一种将 sg 表信息与 page 指针一起编码的方式： root@kitploit: gdb ptype struct scatterlist type = struct scatterlist unsigned long pagelink; unsigned int offset; unsigned int length;...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv – Properly handle EBUSY. Since essiv only handles the special return value of EINPROGERSS, it means that in all other cases, it will free the data related to the request. However, since the caller of essiv may speci...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013560)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013560 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013760)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013760 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011064)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011064 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011221)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011221 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of...

SUSE-SU-2026:0411-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues The following security issues were fixed: - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlbhandleuserfault bsc1254785. - CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit bsc125559...

The vulnerability of the essiv_aead_crypt() function in the essiv component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the essivaeadcrypt function in the essiv component of the Linux operating system is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to fix various security issues The following security issues were fixed: CVE-2022-50282: chardev: fix error handling in cdevdeviceadd bsc1249739. CVE-2022-50630: mm: hugetlb: fix UAF in hugetlbhandleuserfault bsc1254785. CVE-2022-50700: wifi:...

SUSE-SU-2026:0350-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to fix various security issues The following security issues were fixed: - CVE-2022-50282: chardev: fix error handling in cdevdeviceadd bsc1249739. - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlbhandleuserfault bsc1254785. - CVE-2022-50700:...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:0317-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0317-1 advisory. The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues The following security issues were fixed: -...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues The following security issues were fixed: CVE-2022-50630: mm: hugetlb: fix UAF in hugetlbhandleuserfault bsc1254785. CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer bsc1255576. CVE-2023-53254:...

SUSE-SU-2026:0263-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues The following security issues were fixed: - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlbhandleuserfault bsc1254785. - CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer bsc1255576. -...

EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-1091)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : net: drop UFO packets in udprcvsegmentCVE-2025-38622 A transient execution vulnerability in some AMD processors may allow an attacker to infer dat...

EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-1071)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : net: drop UFO packets in udprcvsegmentCVE-2025-38622 A transient execution vulnerability in some AMD processors may allow an attacker to infer dat...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv – The ssizei check is moved to the beginning of essivaeadcrypt, so it is also checked for decryption and in-place encryption...

Exploit for CVE-2025-40019

CVE-2025-40019-Essiv A PoC for CVE-2025-40019 in ESSIV module...

SUSE CVE-2023-54046

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of essiv may specify...

Linux Distros Unpatched Vulnerability : CVE-2023-54046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free dat...