fkie_cve-2025-1146
Vulnerability from fkie_nvd
Published
2025-02-12 19:15
Modified
2025-02-12 19:15
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above. CrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. Windows and Mac sensors are not affected by this.
References
13ddcd98-6f4a-40a8-8e24-29ca0aee4661https://www.crowdstrike.com/security-advisories/cve-2025-1146/
Impacted products
Vendor Product Version


To clipboard 

{
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above.\n\n \nCrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. \n\n\nWindows and Mac sensors are not affected by this.",
      },
      {
         lang: "es",
         value: "CrowdStrike utiliza el estándar industrial TLS (seguridad de la capa de transporte) para proteger las comunicaciones desde el sensor Falcon a la nube de CrowdStrike. CrowdStrike ha identificado un error en la lógica de validación en el sensor Falcon para Linux, Falcon Kubernetes Admission Controller y Falcon Container Sensor, donde nuestra rutina de conexión TLS a la nube de CrowdStrike puede procesar incorrectamente la validación del certificado del servidor. Esto podría permitir que un atacante con la capacidad de controlar el tráfico de la red realice potencialmente un ataque de intermediario (MiTM). CrowdStrike identificó este problema internamente y lanzó una corrección de seguridad en todas las versiones 7.06 y posteriores del sensor Falcon para Linux, Falcon Kubernetes Admission Controller y Falcon Container Sensor. CrowdStrike identificó este problema a través de nuestro riguroso y prolongado proceso de revisión de seguridad, que se ha fortalecido continuamente con un análisis más profundo del código fuente y mejoras continuas del programa como parte de nuestro compromiso con la resiliencia de la seguridad. CrowdStrike no tiene indicios de ninguna explotación de este problema en la naturaleza. CrowdStrike ha aprovechado sus capacidades de inteligencia y búsqueda de amenazas de primer nivel para monitorear activamente los indicios de abuso o uso de esta falla y continuará haciéndolo. Los sensores de Windows y Mac no se ven afectados por esto.",
      },
   ],
   id: "CVE-2025-1146",
   lastModified: "2025-02-12T19:15:09.840",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.2,
            impactScore: 5.9,
            source: "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
            type: "Secondary",
         },
      ],
   },
   published: "2025-02-12T19:15:09.840",
   references: [
      {
         source: "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
         url: "https://www.crowdstrike.com/security-advisories/cve-2025-1146/",
      },
   ],
   sourceIdentifier: "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
   vulnStatus: "Awaiting Analysis",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-296",
            },
         ],
         source: "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
         type: "Secondary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.