[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-DEBIAN-CVE-2025-68183":6},{"stargazers_count":4,"fetched_at":5},7,"2026-06-05T02:55:30.529Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":17,"related":18,"reserved_at":9,"published_at":19,"modified_at":20,"state":9,"summary":21,"references_raw":23,"kevs":30,"epss":9,"epss_history":31,"metrics":32,"affected":33},"DEBIAN-CVE-2025-68183","In the Linux kernel, the following vulnerability has been resolved:  ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr  Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file.  For example, on Fedora, after booting the kernel with \"ima_appraise=fix evm=fix ima_policy=appraise_tcb\" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated,      # getfattr -m - -d -e hex /usr/bin/bash     # file: usr/bin/bash     security.ima=0x0404...  This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed.  Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL.  Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset.  Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL,      #include \u003Cstdio.h>     #include \u003Csys/xattr.h>     #include \u003Cfcntl.h>     #include \u003Cunistd.h>     #include \u003Cstring.h>     #include \u003Cstdlib.h>      int main() {         const char* file_path = \"/usr/sbin/test_binary\";         const char* hex_string = \"030204d33204490066306402304\";         int length = strlen(hex_string);         char* ima_attr_value;         int fd;          fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644);         if (fd == -1) {             perror(\"Error opening file\");             return 1;         }          ima_attr_value = (char*)malloc(length / 2 );         for (int i = 0, j = 0; i \u003C length; i += 2, j++) {             sscanf(hex_string + i, \"%2hhx\", &ima_attr_value[j]);         }          if (fsetxattr(fd, \"security.ima\", ima_attr_value, length/2, 0) == -1) {             perror(\"Error setting extended attribute\");             close(fd);             return 1;         }          const char* selinux_value= \"system_u:object_r:bin_t:s0\";         if (fsetxattr(fd, \"security.selinux\", selinux_value, strlen(selinux_value), 0) == -1) {             perror(\"Error setting extended attribute\");             close(fd);             return 1;         }          close(fd);          return 0;     }",null,[],[],[],[14],{"_key":15},"CVE-2025-68183",[],[],[],"2025-12-16T14:15:50.880Z","2026-04-28T20:30:51.251168Z",{"cisa_kev":22,"cisa_ransomware":22,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[24],{"url":25,"sources":26,"tags":28},"https://security-tracker.debian.org/tracker/CVE-2025-68183",[27],"osv_debian",[29],"Advisory",[],[],[],[34],{"ecosystem":35,"name":36,"vendor":37,"product":36,"cpe_part":9,"purl_type":38,"purl_namespace":37,"purl_name":36,"source":9,"versions":39},"Debian","linux","debian","deb",[40,44,48],{"version":41,"is_range":42,"range_type":43,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":45,"is_range":42,"range_type":43,"version_start":9,"version_start_type":9,"version_end":46,"version_end_type":47,"fixed_in":9},"lt6_12_63_1","6.12.63-1","excluding",{"version":49,"is_range":42,"range_type":43,"version_start":9,"version_start_type":9,"version_end":50,"version_end_type":47,"fixed_in":9},"lt6_17_8_1","6.17.8-1"]