CVE-2025-9613

A vulnerability was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on tag reuse after completion timeouts may allow multiple outstanding Non-Posted Requests to share the same tag. This tag aliasing condition can result in completions being delivered to the wrong security context, potentially compromising data integrity and confidentiality.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://pcisig.com/PCIeIDEStandardVulnerabilities	Vendor Advisory
https://pcisig.com/specifications	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:pcisig:pci_express_integrity_and_data_encryption:-:*:*:*:*:*:*:*

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad fue descubierta en la especificación PCI Express (PCIe) Integrity and Data Encryption (IDE), donde una orientación insuficiente sobre la reutilización de etiquetas después de los tiempos de expiración de finalización puede permitir que varias Solicitudes No Publicadas pendientes compartan la misma etiqueta. Esta condición de alias de etiquetas puede resultar en que las finalizaciones sean entregadas al contexto de seguridad incorrecto, potencialmente comprometiendo la integridad y confidencialidad de los datos.

Information

Published : 2025-12-09 19:15

Updated : 2026-10-14 21:10

NVD link : CVE-2025-9613

Mitre link : CVE-2025-9613

CVE.ORG link : CVE-2025-9613

JSON object : View

Products Affected

pcisig

pci_express_integrity_and_data_encryption

CWE

NVD-CWE-noinfo

{"id": "CVE-2025-9613", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9613", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-10T17:04:05.433232Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "PCI-SIG", "product": "PCI Express Integrity and Data Encryption (PCIe IDE) Specification", "versions": [{"status": "affected", "version": "0", "lessThan": "7.1-Rev7.0", "versionType": "custom"}]}, {"vendor": "PCI-SIG", "product": "PCI Express Integrity and Data Encryption (PCIe IDE) Specification", "versions": [{"status": "affected", "version": "0", "lessThan": "6.5-Rev7.0", "versionType": "custom"}]}]}], "published": "2025-12-09T19:15:50.837", "references": [{"url": "https://pcisig.com/PCIeIDEStandardVulnerabilities", "tags": ["Vendor Advisory"], "source": "cret@cert.org"}, {"url": "https://pcisig.com/specifications", "tags": ["Product"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on tag reuse after completion timeouts may allow multiple outstanding Non-Posted Requests to share the same tag. This tag aliasing condition can result in completions being delivered to the wrong security context, potentially compromising data integrity and confidentiality."}, {"lang": "es", "value": "Una vulnerabilidad fue descubierta en la especificaci\u00f3n PCI Express (PCIe) Integrity and Data Encryption (IDE), donde una orientaci\u00f3n insuficiente sobre la reutilizaci\u00f3n de etiquetas despu\u00e9s de los tiempos de expiraci\u00f3n de finalizaci\u00f3n puede permitir que varias Solicitudes No Publicadas pendientes compartan la misma etiqueta. Esta condici\u00f3n de alias de etiquetas puede resultar en que las finalizaciones sean entregadas al contexto de seguridad incorrecto, potencialmente comprometiendo la integridad y confidencialidad de los datos."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pcisig:pci_express_integrity_and_data_encryption:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FC26D98-4F15-4B0D-B661-BF2894CF8F5B"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}