Към съдържанието
Търсене

CVE-2025-38472: Linux

9.8

CVSS 3.1

0,5%

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP: __nf_ct_delete_from_lists+172] [..] #7 [ff539b5a2b043aa0] nf_ct_delete at ffffffffc124d421 [nf_conntrack] #8 [ff539b5a2b043ad0] nf_ct_gc_expired at ffffffffc124d999 [nf_conntrack] #9 [ff539b5a2b043ae0] __nf_conntrack_find_get at ffffffffc124efbc [nf_conntrack] [..] The nf_conn struct is marked as allocated from slab but appears to be in a partially initialised state: ct hlist pointer is garbage; looks like the ct hash value (hence crash). ct->status is equal to IPS_CONFIRMED|IPS_DYING, which is expected ct->timeout is 30000 (=30s), which is unexpected. Everything else looks like normal udp conntrack entry. If we ignore ct->status and pretend its 0, the entry matches those that are newly allocated but not yet inserted into the hash: - ct hlist pointers are overloaded and store/cache the raw tuple hash - ct->timeout matches the relative time expected for a new udp flow rather than the absolute 'jiffies' value. If it were not for the presence of IPS_CONFIRMED, __nf_conntrack_find_get() would have skipped the entry. Theory is that we did hit following race: cpu x cpu y cpu z found entry E found entry E E is expired <preemption> nf_ct_delete() return E to rcu slab init_conntrack E is re-inited, ct->status set to 0 reply tuplehash hnnode.pprev stores hash value. cpu y found E right before it was deleted on cpu x. E is now re-inited on cpu z. cpu y was preempted before checking for expiry and/or confirm bit. ->refcnt set to 1 E now owned by skb ->timeout set to 30000 If cpu y were to resume now, it would observe E as expired but would skip E due to missing CONFIRMED bit. nf_conntrack_confirm gets called sets: ct->sta

Засегнати продукти

  • Linux Linux: 1397af5bfd7d32b0cf2adb70a78c9a9e8f11d912 преди a47ef874189d47f934d0809ae738886307c0ea22; 1397af5bfd7d32b0cf2adb70a78c9a9e8f11d912 преди 76179961c423cd698080b5e4d5583cf7f4fcdde9; 1397af5bfd7d32b0cf2adb70a78c9a9e8f11d912 преди fc38c249c622ff5e3011b8845fd49dbfd9289afc; 1397af5bfd7d32b0cf2adb70a78c9a9e8f11d912 преди 938ce0e8422d3793fe30df2ed0e37f6bc0598379; 1397af5bfd7d32b0cf2adb70a78c9a9e8f11d912 преди 2d72afb340657f03f7261e9243b44457a9228ac7; 594cea2c09f7cd440d1ee1c4547d5bc6a646b0e4; 5.18.13 преди 5.19
  • Linux Linux: 5.19; преди 5.19; 6.1.147 до 6.1.*; 6.6.100 до 6.6.*; 6.12.40 до 6.12.*; 6.15.8 до 6.15.*; от 6.16 нататък

История

  • 28 юли 2025 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2025-38472: Linux | freedomonline.bg