« Volver al listado

CVE-2025-32022

Estado: AplazadaMedia (4.6)—

Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the `configure` script.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Finit — FinitAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32022",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32022",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-06T17:22:03.799196Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.6,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 0.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "troglobit",
          "product": "finit",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.2, < 4.12"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-05-06T17:16:12.097",
  "references": [
    {
      "url": "https://github.com/troglobit/finit/commit/3feff37ba51fa0a6a0a06f59682a0918aa5b04de",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/troglobit/finit/security/advisories/GHSA-fv6v-vw8h-9x79",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the `configure` script."
    },
    {
      "lang": "es",
      "value": "Finit proporciona un inicio rápido para sistemas Linux. El complemento urandom de Finit presenta una vulnerabilidad de sobrescritura del búfer del montón durante el arranque, lo que provoca que sobrescriba otras partes del montón, lo que podría causar inestabilidades aleatorias y un comportamiento indefinido. El complemento urandom está habilitado por defecto, por lo que este error afecta a todos los usuarios de Finit 4.2 o posterior que no lo desactiven explícitamente durante la compilación. Este error se corrigió en Finit 4.12. Se recomienda encarecidamente a quienes no puedan actualizar o implementar la corrección a urandom.c que desactiven el complemento al llamar al script `configure`."
    }
  ],
  "lastModified": "2026-06-17T09:11:20.177",
  "sourceIdentifier": "security-advisories@github.com"
}