Executive brief
A vulnerability in the Linux kernel's integrity management system could allow the security protections on files to be weakened. When certain security settings are modified, the system may incorrectly downgrade a file's digital signature to a simpler hash, potentially allowing unauthorized modifications to go undetected. This affects systems using Integrity Measurement Architecture (IMA) and Extended Verification Module (EVM) to ensure software authenticity.
Technical details
A vulnerability exists in the Linux kernel's IMA (Integrity Measurement Architecture) appraisal logic within `security/integrity/ima/ima_appraise.c`. When both IMA and EVM (Extended Verification Module) are in 'fix' mode, modifying or removing non-IMA extended attributes (such as security.selinux or ACLs) triggers `ima_reset_appraise_flags`, which incorrectly clears the `IMA_DIGSIG` bit. This causes the kernel to replace a valid digital signature in `security.ima` with a simple file hash upon file close. A local attacker or a malformed installation process could exploit this to downgrade file integrity protections. The issue has been resolved by introducing a tristate logic to `ima_reset_appraise_flags` to prevent accidental clearing of the digital signature flag during unrelated xattr operations.
Affected products
- Linux Linux Kernel 5.14 to 6.17.8
Timeline
- 2025-12-16: advisory: Initial disclosure of CVE-2025-68183
- 2025-11-13: patched: Fix committed to stable tree