CVE-2025-68183

What it actually does

When IMA and EVM are in fix mode, setting or removing non-IMA security xattrs (such as security.selinux, security.evm, or ACLs) clears the IMA_DIGSIG flag that was previously set on a file, causing the kernel to replace a valid IMA signature with a simple file hash on close.

Why it matters to the business

Organizations using IMA appraisal in fix mode on Linux systems may silently lose cryptographic signatures on files during routine package installation or xattr changes, undermining integrity guarantees and potentially allowing tampered files to pass validation or breaking automated policy enforcement.

How an attack unfolds

An attacker or malicious package first writes a valid IMA signature via security.ima, then triggers the bug by setting or removing another security xattr such as security.selinux; on file close the IMA_DIGSIG flag is cleared so the kernel stores only a hash instead of preserving the signature, defeating later appraisal.

How to fix it

Upgrade the Linux kernel to a version containing commit d2993a7e98eb70c737c6f5365a190e79c72b8407 or later. For Chainguard Consul images, update to consul-1.17.4-r15 or newer. Reboot after kernel updates and re-apply IMA policies with ima_appraise=fix evm=fix only after confirming the fix is active.

How to confirm the fix worked

After patching, repeat the minimal C reproducer that sets security.ima followed by security.selinux and verify with getfattr that the IMA_DIGSIG flag (0x0404...) is preserved rather than replaced by a hash; also confirm the fixed commit appears in the running kernel via uname or git describe.

Typical attack path

1. Open or create target file with write access
2. Use fsetxattr to store a crafted or valid IMA signature under security.ima
3. Immediately call fsetxattr on a non-IMA security attribute (security.selinux, security.evm, or ACL)
4. Close the file descriptor to trigger IMA processing
5. Observe that the file now carries only an IMA hash instead of the original signature

How to detect it

Search kernel audit logs and IMA measurement logs for files that unexpectedly transition from having a DIGSIG entry to a hash-only entry after xattr modifications; correlate with package manager activity that touches security.* xattrs.

What your security team should do

• Prioritize kernel upgrades on all systems running IMA/EVM in fix mode before the next package installation cycle
• Audit current IMA policies and switch to enforce mode where feasible to reduce reliance on fix-mode behavior
• Monitor kernel changelogs for additional IMA/EVM fixes and schedule staged rollouts
• Test the reproducer in a lab environment before and after patching to confirm signature preservation