CVE-2025-21670

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21670
In the Linux kernel, the following vulnerability has been resolved: vsock/bpf: return early if transport is not assigned Some of the core functions can only be called if the transport has been assigned. As Michal reported, a socket might have the transport at NULL, for example after a failed connect(), causing the following trace: BUG: kernel NULL pointer dereference, address: 00000000000000a0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+ RIP: 0010:vsock_connectible_has_data+0x1f/0x40 Call Trace: vsock_bpf_recvmsg+0xca/0x5e0 sock_recvmsg+0xb9/0xc0 __sys_recvfrom+0xb3/0x130 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e So we need to check the `vsk->transport` in vsock_bpf_recvmsg(), especially for connected sockets (stream/seqpacket) as we already do in __vsock_connectible_recvmsg().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/58e586c30d0b6f5dc0174a41026f2b0a48c9aab6 Patch
https://git.kernel.org/stable/c/6771e1279dadf1d92a72e1465134257d9e6f2459 Patch
https://git.kernel.org/stable/c/f6abafcd32f9cfc4b1a2f820ecea70773e26d423 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*
History

04 Feb 2025, 15:37

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/58e586c30d0b6f5dc0174a41026f2b0a48c9aab6 - () https://git.kernel.org/stable/c/58e586c30d0b6f5dc0174a41026f2b0a48c9aab6 - Patch
References () https://git.kernel.org/stable/c/6771e1279dadf1d92a72e1465134257d9e6f2459 - () https://git.kernel.org/stable/c/6771e1279dadf1d92a72e1465134257d9e6f2459 - Patch
References () https://git.kernel.org/stable/c/f6abafcd32f9cfc4b1a2f820ecea70773e26d423 - () https://git.kernel.org/stable/c/f6abafcd32f9cfc4b1a2f820ecea70773e26d423 - Patch
CWE CWE-476
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vsock/bpf: retorno anticipado si el transporte no está asignado Algunas de las funciones principales solo se pueden llamar si el transporte ha sido asignado. Como informó Michal, un socket puede tener el transporte en NULL, por ejemplo después de un connect() fallido, lo que provoca el siguiente seguimiento: ERROR: desreferencia de puntero NULL del núcleo, dirección: 00000000000000a0 #PF: acceso de lectura de supervisor en modo núcleo #PF: error_code(0x0000) - página no presente PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 15 UID: 0 PID: 1198 Comm: a.out No contaminado 6.13.0-rc2+ RIP: 0010:vsock_connectible_has_data+0x1f/0x40 Seguimiento de llamada: vsock_bpf_recvmsg+0xca/0x5e0 sock_recvmsg+0xb9/0xc0 __sys_recvfrom+0xb3/0x130 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Por lo tanto, debemos verificar `vsk->transport` en vsock_bpf_recvmsg(), especialmente para sockets conectados (stream/seqpacket) como ya lo hacemos en __vsock_connectible_recvmsg().
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux

31 Jan 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-31 12:15

Updated : 2025-02-04 15:37

NVD link : CVE-2025-21670

Mitre link : CVE-2025-21670

CVE.ORG link : CVE-2025-21670

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference