CVE-2025-65100: Isar Information Disclosure Vulnerability

CVE-2025-65100 Overview

CVE-2025-65100 affects Isar, an integration system for automated root filesystem generation used to build Debian-based embedded Linux images. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not propagate the correct timestamp value to the security distribution suite. Builds continue against outdated security snapshots, causing missed security updates in generated root filesystems. The maintainers patched the flaw via commit 738bcbb. The weakness is classified as CWE-693: Protection Mechanism Failure.

Critical Impact
Root filesystems produced by affected Isar builds omit Debian and Ubuntu security updates, shipping embedded devices with known-vulnerable packages.

Affected Products

Isar 0.11-rc1
Isar 0.11
Root filesystems built with Debian and Ubuntu security snapshot mirrors

Discovery Timeline

2025-11-19 - CVE-2025-65100 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-65100

Vulnerability Analysis

Isar uses BitBake variables to pin package repositories to reproducible snapshot dates. The variable ISAR_APT_SNAPSHOT_DATE sets the timestamp for the primary distribution mirror, while a separate [security] varflag pins the security suite. In affected versions, the varflag was expanded eagerly during parsing, so a user-provided ISAR_APT_SNAPSHOT_DATE never propagated to the security mirror URL. Builds fetched security packages from an outdated snapshot, producing images without current security patches.

Root Cause

The root cause is a variable expansion ordering issue in meta/conf/distro/debian-common.conf and meta/classes/bootstrap.bbclass. The DISTRO_APT_SNAPSHOT_PREMIRROR template read the security varflag with default expansion, capturing the value before user overrides took effect. This constitutes a protection mechanism failure [CWE-693], because the reproducible-build mechanism silently continued using a stale security timestamp instead of the operator-supplied date.

Attack Vector

This is not a directly exploitable network flaw. The impact surfaces downstream: any device built with an affected Isar version inherits missing security updates, exposing the resulting system to already-patched vulnerabilities in Debian or Ubuntu packages. Attackers targeting those unpatched packages on deployed devices gain leverage without exploiting Isar itself.

text

# Patch: meta/conf/distro/debian-common.conf
# Defer expansion of the security varflag so user-supplied dates apply
 DISTRO_APT_SNAPSHOT_PREMIRROR ??= " \
-    deb.debian.org/(debian-security)/? snapshot.debian.org/archive/\1/${@d.getVarFlag('ISAR_APT_SNAPSHOT_DATE', 'security')}\n \
+    deb.debian.org/(debian-security)/? snapshot.debian.org/archive/\1/${@d.getVarFlag('ISAR_APT_SNAPSHOT_DATE', 'security', expand=False)}\n \
     deb.debian.org/(.*)/? snapshot.debian.org/archive/\1/${ISAR_APT_SNAPSHOT_DATE}\n \
 "
# Source: https://github.com/ilbers/isar/commit/3383fd808a4ced93e41e012660dfe364a3384434

text

# Patch: meta/classes/bootstrap.bbclass
# Track the effective snapshot date through internal variables
-ISAR_APT_SNAPSHOT_DATE ?= "${@ get_isar_apt_snapshot_date(d)}"
-ISAR_APT_SNAPSHOT_DATE[security] ?= "${@ get_isar_apt_snapshot_date(d, 'security')}"
+# use internal variables to track where the value comes from
+ISAR_APT_SNAPSHOT_DATE_INTERNAL ?= "${@ get_isar_apt_snapshot_date(d)}"
+ISAR_APT_SNAPSHOT_DATE_INTERNAL[security] ?= "${@ get_isar_apt_snapshot_date(d, 'security')}"
# Source: https://github.com/ilbers/isar/commit/738bcbb716c7eb7b34cbb2293cae4f264b3925fe

Detection Methods for CVE-2025-65100

Indicators of Compromise

Root filesystem images produced by Isar 0.11-rc1 or 0.11 where installed package versions predate current Debian or Ubuntu security advisories.
Build logs referencing snapshot.debian.org/archive/debian-security/ or snapshot.ubuntu.com/ with a timestamp older than the value assigned to ISAR_APT_SNAPSHOT_DATE.
Deployed devices missing security-flagged packages that should have been included per the intended snapshot date.

Detection Strategies

Diff the package manifest of images built before and after applying commit 738bcbb to identify missed security updates.
Parse bitbake build logs for the resolved DISTRO_APT_SNAPSHOT_PREMIRROR URL and compare its security-suite timestamp against the intended date.
Compare installed package versions on shipped devices against the Debian security tracker or Ubuntu security notices.

Monitoring Recommendations

Add continuous integration checks that assert the resolved security snapshot URL matches ISAR_APT_SNAPSHOT_DATE on every build.
Maintain a software bill of materials (SBOM) for each firmware release and monitor it against upstream CVE feeds.
Alert on Isar version pins that reference 0.11-rc1 or 0.11 in build recipes or CI configurations.

How to Mitigate CVE-2025-65100

Immediate Actions Required

Update Isar to a revision containing commit 738bcbb716c7eb7b34cbb2293cae4f264b3925fe and rebuild all affected images.
Audit recent firmware releases built with Isar 0.11-rc1 or 0.11 and reissue images that shipped with stale security snapshots.
Verify the resolved security mirror URL in build output matches the operator-supplied ISAR_APT_SNAPSHOT_DATE value.

Patch Information

The fix is delivered through two commits in the ilbers/isar repository. Commit 3383fd8 lazily expands the ISAR_APT_SNAPSHOT_DATE[security] varflag in debian-common.conf. Commit 738bcbb introduces ISAR_APT_SNAPSHOT_DATE_INTERNAL to correctly derive the distribution snapshot date from provided values. Full context is available in GitHub Security Advisory GHSA-3r9w-6cp6-7hm4.

Workarounds

Explicitly set the ISAR_APT_SNAPSHOT_DATE[security] varflag in local configuration to force the security suite to the intended timestamp.
Override DISTRO_APT_SNAPSHOT_PREMIRROR in a local .conf file to hard-code a current security snapshot URL until patching completes.
Pin Isar to a pre-0.11-rc1 release that used a different snapshot handling mechanism until upgrades are validated.

bash

# Explicitly set both the default and security snapshot dates in local.conf
ISAR_APT_SNAPSHOT_DATE = "20251101T000000Z"
ISAR_APT_SNAPSHOT_DATE[security] = "20251101T000000Z"

# Verify the resolved premirror includes the expected security timestamp
bitbake -e <image-recipe> | grep DISTRO_APT_SNAPSHOT_PREMIRROR