CVE-2025-21857

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21857
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix error handling causing NULL dereference tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to caller tcf_exts_init_ex() which sets exts->actions to NULL and returns 1 to caller fl_change(). fl_change() treats err == 1 as success, calling tcf_exts_validate_ex() which calls tcf_action_init() with exts->actions as argument, where it is dereferenced. Example trace: BUG: kernel NULL pointer dereference, address: 0000000000000000 CPU: 114 PID: 16151 Comm: handler114 Kdump: loaded Not tainted 5.14.0-503.16.1.el9_5.x86_64 #1 RIP: 0010:tcf_action_init+0x1f8/0x2c0 Call Trace: tcf_action_init+0x1f8/0x2c0 tcf_exts_validate_ex+0x175/0x190 fl_change+0x537/0x1120 [cls_flower]

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/071ed42cff4fcdd89025d966d48eabef59913bf2 Patch
https://git.kernel.org/stable/c/3c74b5787caf59bb1e9c5fe0a360643a71eb1e8a Patch
https://git.kernel.org/stable/c/3e4c56cf41876ef2a82f0877fe2a67648f8632b8 Patch
https://git.kernel.org/stable/c/de4b679aa3b4da7ec34f639df068b914f20e3c3c Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
History

13 Mar 2025, 21:15

Type Values Removed Values Added
CWE CWE-476
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sched: cls_api: se corrige el error de gestión que causa la desreferencia de NULL. tcf_exts_miss_cookie_base_alloc() llama a xa_alloc_cyclic(), que puede devolver 1 si la asignación se realizó correctamente tras el encapsulado. Esto se trató como un error, con el valor 1 devuelto al llamador tcf_exts_init_ex(), que establece exts->actions en NULL y devuelve 1 al llamador fl_change(). fl_change() trata err == 1 como correcto, llamando a tcf_exts_validate_ex(), que llama a tcf_action_init() con exts->actions como argumento, donde se desreferencia. Ejemplo de seguimiento: ERROR: desreferencia de puntero NULL del núcleo, dirección: 0000000000000000 CPU: 114 PID: 16151 Comm: handler114 Kdump: cargado No contaminado 5.14.0-503.16.1.el9_5.x86_64 #1 RIP: 0010:tcf_action_init+0x1f8/0x2c0 Seguimiento de llamadas: tcf_action_init+0x1f8/0x2c0 tcf_exts_validate_ex+0x175/0x190 fl_change+0x537/0x1120 [cls_flower]
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/071ed42cff4fcdd89025d966d48eabef59913bf2 - () https://git.kernel.org/stable/c/071ed42cff4fcdd89025d966d48eabef59913bf2 - Patch
References () https://git.kernel.org/stable/c/3c74b5787caf59bb1e9c5fe0a360643a71eb1e8a - () https://git.kernel.org/stable/c/3c74b5787caf59bb1e9c5fe0a360643a71eb1e8a - Patch
References () https://git.kernel.org/stable/c/3e4c56cf41876ef2a82f0877fe2a67648f8632b8 - () https://git.kernel.org/stable/c/3e4c56cf41876ef2a82f0877fe2a67648f8632b8 - Patch
References () https://git.kernel.org/stable/c/de4b679aa3b4da7ec34f639df068b914f20e3c3c - () https://git.kernel.org/stable/c/de4b679aa3b4da7ec34f639df068b914f20e3c3c - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

12 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-12 10:15

Updated : 2025-03-13 21:15

NVD link : CVE-2025-21857

Mitre link : CVE-2025-21857

CVE.ORG link : CVE-2025-21857

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference