CVE-2025-21919

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21919
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq. This 'prev' pointer can originate from struct rq's leaf_cfs_rq_list, making the conversion invalid and potentially leading to memory corruption. Depending on the relative positions of leaf_cfs_rq_list and the task group (tg) pointer within the struct, this can cause a memory fault or access garbage data. The issue arises in list_add_leaf_cfs_rq, where both cfs_rq->leaf_cfs_rq_list and rq->leaf_cfs_rq_list are added to the same leaf list. Also, rq->tmp_alone_branch can be set to rq->leaf_cfs_rq_list. This adds a check `if (prev == &rq->leaf_cfs_rq_list)` after the main conditional in child_cfs_rq_on_list. This ensures that the container_of operation will convert a correct cfs_rq struct. This check is sufficient because only cfs_rqs on the same CPU are added to the list, so verifying the 'prev' pointer against the current rq's list head is enough. Fixes a potential memory corruption issue that due to current struct layout might not be manifesting as a crash but could lead to unpredictable behavior when the layout changes.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/000c9ee43928f2ce68a156dd40bab7616256f4dd Patch
https://git.kernel.org/stable/c/3b4035ddbfc8e4521f85569998a7569668cccf51 Patch
https://git.kernel.org/stable/c/5cb300dcdd27e6a351ac02541e0231261c775852 Patch
https://git.kernel.org/stable/c/9cc7f0018609f75a349e42e3aebc3b0e905ba775 Patch
https://git.kernel.org/stable/c/b5741e4b9ef3567613b2351384f91d3f16e59986 Patch
https://git.kernel.org/stable/c/e1dd09df30ba86716cb2ffab97dc35195c01eb8f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
History

11 Apr 2025, 13:16

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/000c9ee43928f2ce68a156dd40bab7616256f4dd - () https://git.kernel.org/stable/c/000c9ee43928f2ce68a156dd40bab7616256f4dd - Patch
References () https://git.kernel.org/stable/c/3b4035ddbfc8e4521f85569998a7569668cccf51 - () https://git.kernel.org/stable/c/3b4035ddbfc8e4521f85569998a7569668cccf51 - Patch
References () https://git.kernel.org/stable/c/5cb300dcdd27e6a351ac02541e0231261c775852 - () https://git.kernel.org/stable/c/5cb300dcdd27e6a351ac02541e0231261c775852 - Patch
References () https://git.kernel.org/stable/c/9cc7f0018609f75a349e42e3aebc3b0e905ba775 - () https://git.kernel.org/stable/c/9cc7f0018609f75a349e42e3aebc3b0e905ba775 - Patch
References () https://git.kernel.org/stable/c/b5741e4b9ef3567613b2351384f91d3f16e59986 - () https://git.kernel.org/stable/c/b5741e4b9ef3567613b2351384f91d3f16e59986 - Patch
References () https://git.kernel.org/stable/c/e1dd09df30ba86716cb2ffab97dc35195c01eb8f - () https://git.kernel.org/stable/c/e1dd09df30ba86716cb2ffab97dc35195c01eb8f - Patch
CWE CWE-787
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sched/fair: Se corrige la posible corrupción de memoria en child_cfs_rq_on_list. child_cfs_rq_on_list intenta convertir un puntero 'prev' en un cfs_rq. Este puntero 'prev' puede originarse en leaf_cfs_rq_list de struct rq, invalidando la conversión y potencialmente provocando corrupción de memoria. Dependiendo de las posiciones relativas de leaf_cfs_rq_list y el puntero del grupo de tareas (tg) dentro de la estructura, esto puede causar un fallo de memoria o acceder a datos basura. El problema surge en list_add_leaf_cfs_rq, donde tanto cfs_rq->leaf_cfs_rq_list como rq->leaf_cfs_rq_list se añaden a la misma lista de hojas. Además, rq->tmp_alone_branch puede establecerse en rq->leaf_cfs_rq_list. Esto añade una comprobación `if (prev == &rq->leaf_cfs_rq_list)` después de la condición principal en child_cfs_rq_on_list. Esto garantiza que la operación container_of convierta una estructura cfs_rq correcta. Esta comprobación es suficiente porque solo se añaden a la lista las cfs_rqs en la misma CPU, por lo que basta con verificar el puntero `prev` con la cabecera de la lista de la rq actual. Corrige un posible problema de corrupción de memoria que, debido al diseño actual de la estructura, podría no manifestarse como un fallo, pero podría provocar un comportamiento impredecible al cambiar el diseño.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux

01 Apr 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 16:15

Updated : 2025-04-11 13:16

NVD link : CVE-2025-21919

Mitre link : CVE-2025-21919

CVE.ORG link : CVE-2025-21919

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write