CVE-2025-6365
📋 TL;DR
This vulnerability in HobbesOSR Kitten's set_pte_at function allows attackers to cause resource consumption (denial of service) by manipulating page table entries. It affects all versions up to commit c4f8b7c3158983d1020af432be1b417b28686736. Users of HobbesOSR Kitten on ARM64 systems are vulnerable.
💻 Affected Systems
- HobbesOSR Kitten
📦 What is this software?
Kitten by Hobbesosr
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability due to resource exhaustion, potentially requiring physical reboot of affected systems.
Likely Case
Degraded system performance, application crashes, or temporary service interruptions due to resource starvation.
If Mitigated
Minimal impact with proper resource monitoring and isolation, though some performance degradation may still occur.
🎯 Exploit Status
Exploitation requires understanding of ARM64 page table structures and ability to trigger the vulnerable function. No public exploits have been reported.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit c4f8b7c3158983d1020af432be1b417b28686736
Vendor Advisory: https://github.com/HobbesOSR/kitten/issues/17
Restart Required: Yes
Instructions:
1. Update to the latest HobbesOSR Kitten version after the fix commit. 2. Rebuild and redeploy affected systems. 3. Restart services using the updated kernel/library.
🔧 Temporary Workarounds
Resource Limiting
linuxImplement strict resource limits to contain potential resource exhaustion
# Use cgroups to limit memory and CPU usage
cgcreate -g memory,cpu:/kitten-limited
cgset -r memory.limit_in_bytes=2G /kitten-limited
cgset -r cpu.cfs_quota_us=50000 /kitten-limited
Isolation via Containers
linuxRun vulnerable components in isolated containers with resource constraints
docker run --memory="2g" --cpus="0.5" -d your-kitten-image
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from untrusted networks
- Deploy monitoring for abnormal resource consumption patterns and set up automated alerts
🔍 How to Verify
Check if Vulnerable:
Check if running HobbesOSR Kitten with commit hash at or before c4f8b7c3158983d1020af432be1b417b28686736Check Version:
git log --oneline -1 | grep -o '[a-f0-9]\{40\}'Verify Fix Applied:
Verify current commit hash is after c4f8b7c3158983d1020af432be1b417b28686736📡 Detection & Monitoring
Log Indicators:
- Unusual memory allocation patterns
- Kernel OOM (Out of Memory) killer events
- Process crashes with resource exhaustion errors
Network Indicators:
- Unusual traffic patterns to/from affected systems
- Multiple connection attempts to trigger the vulnerability
SIEM Query:
source="kernel" AND ("out of memory" OR "oom" OR "resource exhaustion") AND process="kitten"