SECUFOCUSNOW
Home›CVE index›CVE-2025-22083
Review reviewHigh

CVE-2025-22083

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang: 1. Use-after-free when no tpgs are found: This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds tpgs to add to the vs_tpg array match=true, so we will do:...

CVSS
7.8
EPSS
0.20%
9.56% percentile
CISA KEV
Not listed
Published
2025.04.17
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.20%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang: 1. Use-after-free when no tpgs are found: This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds tpgs to add to the vs_tpg array match=true, so we will do:...

Affected product and versions

Product
Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Affected versions
>= 4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 < 451c72f5e7cf5d339a6410a635cee0825687c3dc, >= 4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 < 2b34bdc42df047794542f3e220fe989124e4499a, >= 4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 < 3a19eb3d9818e28f14c818a18dc913344a52ca92, >= 4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 < 3fd054baf382a426bbf5135ede0fc5673db74d3e, >= 4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 < 63b449f73ab0dcc0ba11ceaa4c5c70bc86ccf03c, >= 4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 < 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6, >= 3.9, >= V3.1.6, >= 3.9.1 < 6.6.87, >= 6.7 < 6.12.23, >= 6.13 < 6.13.11, >= 6.14 < 6.14.2, 3.9
Fixed versions
6.6.87, 6.12.23, 6.13.11, 6.14.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416
CVE-2025-22083 — Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | SECUFOCUS NOW