PT-2025-6837 · Crowdstrike · Falcon Container Sensor+2
Published
2025-02-12
·
Updated
2025-05-12
·
CVE-2025-1146
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Falcon Sensor for Linux versions prior to 7.06
Falcon Kubernetes Admission Controller versions prior to 7.06
Falcon Container Sensor versions prior to 7.06
Description
The issue is related to a validation logic error in the TLS connection routine to the CrowdStrike cloud, which could allow an attacker to conduct a man-in-the-middle (MiTM) attack. The error is in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor. CrowdStrike has no indication of any exploitation of this issue in the wild and has leveraged its threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw.
Recommendations
For Falcon Sensor for Linux versions prior to 7.06, update to version 7.06 or above.
For Falcon Kubernetes Admission Controller versions prior to 7.06, update to version 7.06 or above.
For Falcon Container Sensor versions prior to 7.06, update to version 7.06 or above.
As a temporary workaround, consider restricting access to the TLS connection routine to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Falcon Container Sensor
Falcon Kubernetes Admission Controller
Falcon Sensor For Linux