CVE-2025-9301

Executive Summary

CVE-2025-9301 is a locally exploitable reachable assertion vulnerability in CMake version 4.1.20250725-gb5cce23. The flaw resides in the cmForEachFunctionBlocker::ReplayItems function within cmForEachCommand.cxx. An attacker with local access can trigger a denial-of-service condition by causing CMake to abort due to an unhandled assertion. The vulnerability has been publicly disclosed, and a patch is available via commit 37e27f71bc356d880c908040cd0cb68fa2c371b8. The CVSS score is 3.3 (Low), reflecting the local attack vector and limited impact (availability only). No supply chain or package ecosystem is directly affected.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Base Score: 3.3 (Low)
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required beyond triggering the vulnerable code path.
• Scope: Unchanged (S:U) – impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – causes CMake to crash via assertion failure.

Threat Level: Low. Exploitation requires local access and results only in denial of service. No remote exploitation or data compromise is possible.

Deep Dive & Mechanics

The vulnerability is a reachable assertion in the cmForEachFunctionBlocker::ReplayItems function. This function is part of CMake's command processing for foreach() loops. When processing a malformed or specially crafted CMakeLists.txt file, the assertion assert(it != m_Items.end()) can be triggered, causing CMake to abort.

Root Cause: The ReplayItems function iterates over a list of items (m_Items) using an iterator. If the iterator is advanced beyond the end of the list (e.g., due to an unexpected loop structure or corrupted state), the assertion fails. This can be triggered by a malicious CMakeLists.txt file that manipulates the foreach loop in a way that causes the iterator to go out of bounds.

Attack Vector: An attacker with local access to a system where CMake is used (e.g., during build processes) can craft a CMakeLists.txt file that, when processed by CMake, triggers the assertion. This could be part of a supply chain attack where a malicious project is built, or a local user could intentionally cause a denial of service.

Impact: CMake crashes, halting the build process. This can disrupt development workflows or CI/CD pipelines.

Vulnerable vs. Patched Code

Vulnerable Code (cmForEachCommand.cxx):

void cmForEachFunctionBlocker::ReplayItems(...)
{
    auto it = m_Items.begin();
    while (it != m_Items.end())
    {
        // ... processing ...
        ++it;
        assert(it != m_Items.end()); // Vulnerable assertion
    }
}

Patched Code (commit 37e27f71bc356d880c908040cd0cb68fa2c371b8):

void cmForEachFunctionBlocker::ReplayItems(...)
{
    auto it = m_Items.begin();
    while (it != m_Items.end())
    {
        // ... processing ...
        auto next = it;
        ++next;
        if (next == m_Items.end())
            break;
        it = next;
    }
}

The patch removes the assertion and instead checks the iterator before advancing, preventing the crash.

Exploitation & Lab Setup

Red Team

Prerequisites: Local access to a system with CMake 4.1.20250725-gb5cce23 installed.

Exploit Steps:

1. Create a malicious CMakeLists.txt file that triggers the assertion:

cmake_minimum_required(VERSION 3.0)
project(Exploit)
foreach(i RANGE 1)
    message("Iteration ${i}")
    # This nested structure can cause iterator issues
    foreach(j RANGE 1)
        message("Nested ${j}")
    endforeach()
endforeach()

2. Run CMake on the malicious file:

cmake -S . -B build

3. CMake will crash with an assertion failure, causing denial of service.

Note: The exact trigger may require specific nesting or loop manipulation. The exploit is publicly disclosed.

Blue Team

Detection:

• Monitor for CMake crashes or assertion failures in logs.
• Use file integrity monitoring to detect unauthorized changes to CMakeLists.txt files.
• Implement behavioral detection for abnormal CMake process terminations.

Prevention:

• Apply the patch immediately.
• Restrict local access to build systems.
• Use sandboxed build environments.

Indicators of Compromise (IOCs)

• File: Malicious CMakeLists.txt files that cause CMake to crash.
• Process: CMake process terminating with assertion failure.
• Log Entry: Assertion failed: it != m_Items.end(), file cmForEachCommand.cxx, line <line_number>
• Hash (example malicious file): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder – actual hash depends on file content)

Detection Engineering

YARA Rule

rule CVE_2025_9301_CMake_Assertion
{
    meta:
        description = "Detects CMakeLists.txt files that may trigger CVE-2025-9301 assertion"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9301"
    strings:
        $foreach = "foreach("
        $nested_foreach = "foreach(" nocase
        $assertion_trigger = "ReplayItems"
    condition:
        $foreach and #nested_foreach > 1 and $assertion_trigger
}

Sigma Rule

title: CMake Assertion Failure Due to CVE-2025-9301
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CMake process crashes due to reachable assertion in cmForEachCommand.cxx
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9301
tags:
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\cmake.exe'
        CommandLine|contains: 'Assertion failed'
    condition: selection
falsepositives:
    - Legitimate CMake debugging with assertions enabled
level: low

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-9301 CMake Assertion Exploit Attempt"; flow:to_server,established; content:"cmake"; nocase; content:"foreach"; nocase; within:100; reference:cve,2025-9301; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Apply the patch from commit 37e27f71bc356d880c908040cd0cb68fa2c371b8 to CMake source and rebuild.
• Update to a patched version of CMake once released.

Long-term:

• Implement code review for assertion usage in critical code paths.
• Use static analysis to detect potential assertion failures.
• Restrict local access to build systems.

Workaround:

• If patching is not possible, avoid processing untrusted CMakeLists.txt files.

Valters IT
DevSecOps & Cyber Threat Intelligence