The vulnerability affects versions of the Falcon Sensor for Linux and related components prior to version 7.06. The issue arises from incorrect processing of server certificates during TLS communication with the CrowdStrike cloud. CrowdStrike has disclosed a high-severity vulnerability in its Falcon Sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor. This vulnerability could allow attackers with control over network traffic to conduct man-in-the-middle (MiTM) attacks by exploiting improper server certificate validation. The vulnerability exclusively affects Linux-based systems running the Falcon Sensor or its Kubernetes and container-specific counterparts. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The vulnerability, identified as CVE-2025-1146, originates from a validation logic error in the Transport Layer Security (TLS) connection routine. The vulnerability is classified under CWE-296 (“Improper Following of a Certificate’s Chain of Trust”) and CAPEC-94 (“Adversary in the Middle”), highlighting its nature as a certificate validation weakness. CrowdStrike identified the vulnerability during internal testing, following identifying the flaw, CrowdStrike released a fix in versions 7.06 and later for all affected products. CrowdStrike emphasized that no evidence exists of this vulnerability being exploited in real-world attacks to date.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 13 Feb 2025 04:25:22 +0000