CVE-2025-9408CWE-270

CVE-2025-9408

High · published November 11, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
1.9
In the wild
Unconfirmed
What it is

⚡ A sneaky race condition in the system call entry can pave the way for privilege escalation on Cortex M devices. 🔥 Think of it like a hotel with two front desks: if both employees are busy checking in guests at the same time without clear procedures, a crafty guest could slip into a premium suite before anyone notices! An attacker could exploit this race condition to gain elevated privileges, potentially accessing or modifying sensitive system resources. This could lead to unauthorized control over the device, allowing malicious processes to operate with rights they shouldn't have. 🚨

Put simply

Think of it like a hotel with two front desks: if both employees are busy checking in guests at the same time without clear procedures, a crafty guest could slip into a premium suite before anyone notices! This vulnerability arises from a race condition during system call entry, enabling unauthorized userspace processes to escalate their privileges by taking advantage of the timing between two processes competing for resource access.

What to do

An attacker could exploit this race condition to gain elevated privileges, potentially accessing or modifying sensitive system resources. This could lead to unauthorized control over the device, allowing malicious processes to operate with rights they shouldn't have. 🚨 To remediate, ensure you apply security patches from the vendor as soon as they're available. Review your system configurations for any settings that may mitigate race conditions, and conduct a thorough audit of running processes for suspicious activities. 🛡️ You've got this! Stay vigilant, follow these steps, and keep your systems secure! 🌟

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00123 · 1.9th percentile
Weakness
CWE-270 · Privilege Context Switching Error
Published
2025-11-11T21:15Z
References (1)
EPSS history
Timeline
  • 11 NOV 15:34Z
    Userspace privilege escalation vulnerability on Cortex M
    cvelistv5