« Volver al listado

CVE-2025-48769

Estado: AnalizadaAlta (8.1)—

Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results.

This issue affects Apache NuttX RTOS: from 7.20 before 12.11.0.

Users of virtual filesystem based services with write access especially when exposed over the network (i.e. FTP) are affected and recommended to upgrade to version 12.11.0 that fixes the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N, PR:L, UI:N: acceso red con privilegios (Use After Free en rename VFS). El impacto primary es manipulación de datos (rename/move no deseados); secondary es ejecución si el atacante controla qué se renombra (ej. librerías).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based Content

Tecnologías afectadas (1)

Apache — Nuttx

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-48769",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-48769",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-05T20:06:45.981815Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache NuttX RTOS",
          "versions": [
            {
              "status": "affected",
              "version": "7.20",
              "lessThan": "12.11.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-01T17:15:43.243",
  "references": [
    {
      "url": "https://github.com/apache/nuttx/pull/16455",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/7m83v11ldfq7bvw72n9t5sccocczocjn",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/12/31/11",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results.\n\nThis issue affects Apache NuttX RTOS: from 7.20 before 12.11.0.\n\nUsers of virtual filesystem based services with write access especially when exposed over the network (i.e. FTP) are affected and recommended to upgrade to version 12.11.0 that fixes the issue."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad Use After Free fue descubierta en el código fs/vfs/fs_rename del RTOS Apache NuttX, que debido a la implementación recursiva y al uso de un único búfer por dos variables de puntero diferentes, permitió la reasignación de un búfer de tamaño arbitrario proporcionado por el usuario y la escritura en el fragmento de memoria del heap previamente liberado, lo que en casos específicos podría causar resultados inesperados en las operaciones de renombrar/mover del sistema de archivos virtual.\n\nEste problema afecta a Apache NuttX RTOS: desde 7.20 antes de 12.11.0.\n\nLos usuarios de servicios basados en sistemas de archivos virtuales con acceso de escritura, especialmente cuando están expuestos a través de la red (es decir, FTP), se ven afectados y se les recomienda actualizar a la versión 12.11.0 que corrige el problema."
    }
  ],
  "lastModified": "2026-10-01T08:10:00.183",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81ECDE8C-6BF7-4DFA-8054-18D43595BC63",
              "versionEndExcluding": "12.11.0",
              "versionStartIncluding": "7.20"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}