Към съдържанието
Търсене

CVE-2025-21707: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: mptcp: consolidate suboption status MPTCP maintains the received sub-options status is the bitmask carrying the received suboptions and in several bitfields carrying per suboption additional info. Zeroing the bitmask before parsing is not enough to ensure a consistent status, and the MPTCP code has to additionally clear some bitfiled depending on the actually parsed suboption. The above schema is fragile, and syzbot managed to trigger a path where a relevant bitfield is not cleared/initialized: BUG: KMSAN: uninit-value in __mptcp_expand_seq net/mptcp/options.c:1030 [inline] BUG: KMSAN: uninit-value in mptcp_expand_seq net/mptcp/protocol.h:864 [inline] BUG: KMSAN: uninit-value in ack_update_msk net/mptcp/options.c:1060 [inline] BUG: KMSAN: uninit-value in mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209 __mptcp_expand_seq net/mptcp/options.c:1030 [inline] mptcp_expand_seq net/mptcp/protocol.h:864 [inline] ack_update_msk net/mptcp/options.c:1060 [inline] mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209 tcp_data_queue+0xb4/0x7be0 net/ipv4/tcp_input.c:5233 tcp_rcv_established+0x1061/0x2510 net/ipv4/tcp_input.c:6264 tcp_v4_do_rcv+0x7f3/0x11a0 net/ipv4/tcp_ipv4.c:1916 tcp_v4_rcv+0x51df/0x5750 net/ipv4/tcp_ipv4.c:2351 ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:460 [inline] ip_rcv_finish+0x4a2/0x520 net/ipv4/ip_input.c:447 NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0xcd/0x380 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core net/core/dev.c:5704 [inline] __netif_receive_skb+0x319/0xa00 net/core/dev.c:5817 process_backlog+0x4ad/0xa50 net/core/dev.c:6149 __napi_poll+0xe7/0x980 net/core/dev.c:6902

    Засегнати продукти

    • Linux Linux: 84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc преди 3a7fda57b0f91f7ea34476b165f91a92feb17c96; 84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc преди 3b5332d416d151a15742d1b16e7319368e3cc5c6; 84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc преди 7f6c72b8ef8130760710e337dc8fbe7263954884; 84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc преди 6169e942370b4b6f9442d35c51519bf6c346843b; 84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc преди ba0518f9e8688cd4fcb569e8df2a74874b4f3894; 84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc преди c86b000782daba926c627d2fa00c3f60a75e7472
    • Linux Linux: 5.11; преди 5.11; 5.15.179 до 5.15.*; 6.1.129 до 6.1.*; 6.6.76 до 6.6.*; 6.12.13 до 6.12.*; 6.13.2 до 6.13.*; от 6.14 нататък
    • Siemens: още 4 продукта, добавени от Siemens

      SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

    История

    • 27 февруари 2025 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2025-21707: Linux | freedomonline.bg