CVE-2025-21647 (GCVE-0-2025-21647)
Vulnerability from cvelistv5
Published
2025-01-19 10:18
Modified
2025-05-04 13:06
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access. To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error). As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour.
References
Impacted products
Vendor Product Version
Linux Linux Version: 4a4eeefa514db570be025ab46d779af180e2c9bb
Version: 7725152b54d295b7da5e34c2f419539b30d017bd
Version: cde71a5677971f4f1b69b25e854891dbe78066a4
Version: 549e407569e08459d16122341d332cb508024094
Version: d4a9039a7b3d8005b90c7b1a55a306444f0e5447
Version: 546ea84d07e3e324644025e2aae2d12ea4c5896e
Version: 546ea84d07e3e324644025e2aae2d12ea4c5896e
Version: d7c01c0714c04431b5e18cf17a9ea68a553d1c3c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44fe1efb4961c1a5ccab16bb579dfc6b308ad58b",
              "status": "affected",
              "version": "4a4eeefa514db570be025ab46d779af180e2c9bb",
              "versionType": "git"
            },
            {
              "lessThan": "b1a1743aaa4906c41c426eda97e2e2586f79246d",
              "status": "affected",
              "version": "7725152b54d295b7da5e34c2f419539b30d017bd",
              "versionType": "git"
            },
            {
              "lessThan": "bb0245fa72b783cb23a9949c5048781341e91423",
              "status": "affected",
              "version": "cde71a5677971f4f1b69b25e854891dbe78066a4",
              "versionType": "git"
            },
            {
              "lessThan": "a777e06dfc72bed73c05dcb437d7c27ad5f90f3f",
              "status": "affected",
              "version": "549e407569e08459d16122341d332cb508024094",
              "versionType": "git"
            },
            {
              "lessThan": "27202e2e8721c3b23831563c36ed5ac7818641ba",
              "status": "affected",
              "version": "d4a9039a7b3d8005b90c7b1a55a306444f0e5447",
              "versionType": "git"
            },
            {
              "lessThan": "91bb18950b88f955838ec0c1d97f74d135756dc7",
              "status": "affected",
              "version": "546ea84d07e3e324644025e2aae2d12ea4c5896e",
              "versionType": "git"
            },
            {
              "lessThan": "737d4d91d35b5f7fa5bb442651472277318b0bfd",
              "status": "affected",
              "version": "546ea84d07e3e324644025e2aae2d12ea4c5896e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d7c01c0714c04431b5e18cf17a9ea68a553d1c3c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "5.4.284",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.10.226",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.15.167",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.125",
                  "versionStartIncluding": "6.1.110",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.72",
                  "versionStartIncluding": "6.6.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: sch_cake: add bounds checks to host bulk flow fairness counts\n\nEven though we fixed a logic error in the commit cited below, syzbot\nstill managed to trigger an underflow of the per-host bulk flow\ncounters, leading to an out of bounds memory access.\n\nTo avoid any such logic errors causing out of bounds memory accesses,\nthis commit factors out all accesses to the per-host bulk flow counters\nto a series of helpers that perform bounds-checking before any\nincrements and decrements. This also has the benefit of improving\nreadability by moving the conditional checks for the flow mode into\nthese helpers, instead of having them spread out throughout the\ncode (which was the cause of the original logic error).\n\nAs part of this change, the flow quantum calculation is consolidated\ninto a helper function, which means that the dithering applied to the\nost load scaling is now applied both in the DRR rotation and when a\nsparse flow\u0027s quantum is first initiated. The only user-visible effect\nof this is that the maximum packet size that can be sent while a flow\nstays sparse will now vary with +/- one byte in some cases. This should\nnot make a noticeable difference in practice, and thus it\u0027s not worth\ncomplicating the code to preserve the old behaviour."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T13:06:10.192Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44fe1efb4961c1a5ccab16bb579dfc6b308ad58b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1a1743aaa4906c41c426eda97e2e2586f79246d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb0245fa72b783cb23a9949c5048781341e91423"
        },
        {
          "url": "https://git.kernel.org/stable/c/a777e06dfc72bed73c05dcb437d7c27ad5f90f3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/27202e2e8721c3b23831563c36ed5ac7818641ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/91bb18950b88f955838ec0c1d97f74d135756dc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/737d4d91d35b5f7fa5bb442651472277318b0bfd"
        }
      ],
      "title": "sched: sch_cake: add bounds checks to host bulk flow fairness counts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21647",
    "datePublished": "2025-01-19T10:18:04.415Z",
    "dateReserved": "2024-12-29T08:45:45.728Z",
    "dateUpdated": "2025-05-04T13:06:10.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21647\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-19T11:15:10.307\",\"lastModified\":\"2025-03-13T13:15:47.797\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched: sch_cake: add bounds checks to host bulk flow fairness counts\\n\\nEven though we fixed a logic error in the commit cited below, syzbot\\nstill managed to trigger an underflow of the per-host bulk flow\\ncounters, leading to an out of bounds memory access.\\n\\nTo avoid any such logic errors causing out of bounds memory accesses,\\nthis commit factors out all accesses to the per-host bulk flow counters\\nto a series of helpers that perform bounds-checking before any\\nincrements and decrements. This also has the benefit of improving\\nreadability by moving the conditional checks for the flow mode into\\nthese helpers, instead of having them spread out throughout the\\ncode (which was the cause of the original logic error).\\n\\nAs part of this change, the flow quantum calculation is consolidated\\ninto a helper function, which means that the dithering applied to the\\nost load scaling is now applied both in the DRR rotation and when a\\nsparse flow\u0027s quantum is first initiated. The only user-visible effect\\nof this is that the maximum packet size that can be sent while a flow\\nstays sparse will now vary with +/- one byte in some cases. This should\\nnot make a noticeable difference in practice, and thus it\u0027s not worth\\ncomplicating the code to preserve the old behaviour.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sched: sch_cake: agregar comprobaciones de los l\u00edmites a los recuentos de equidad de flujo masivo del host Aunque arreglamos un error l\u00f3gico en el commit citada a continuaci\u00f3n, syzbot a\u00fan logr\u00f3 activar un desbordamiento de los contadores de flujo masivo por host, lo que provoc\u00f3 un acceso a la memoria fuera de los l\u00edmites. Para evitar que dichos errores l\u00f3gicos provoquen accesos a la memoria fuera de los l\u00edmites, esta confirmaci\u00f3n elimina todos los accesos a los contadores de flujo masivo por host a una serie de ayudantes que realizan la comprobaci\u00f3n de los l\u00edmites antes de cualquier incremento o decremento. Esto tambi\u00e9n tiene el beneficio de mejorar la legibilidad al mover las comprobaciones condicionales para el modo de flujo a estos ayudantes, en lugar de tenerlas distribuidas por todo el c\u00f3digo (que era la causa del error l\u00f3gico original). Como parte de este cambio, el c\u00e1lculo cu\u00e1ntico de flujo se consolida en una funci\u00f3n auxiliar, lo que significa que el tramado aplicado al escalamiento de carga ost ahora se aplica tanto en la rotaci\u00f3n DRR como cuando se inicia por primera vez el cu\u00e1ntico de un flujo disperso. El \u00fanico efecto visible para el usuario es que el tama\u00f1o m\u00e1ximo de paquete que se puede enviar mientras un flujo permanece disperso variar\u00e1 ahora en +/- un byte en algunos casos. Esto no deber\u00eda suponer una diferencia notable en la pr\u00e1ctica y, por lo tanto, no vale la pena complicar el c\u00f3digo para conservar el comportamiento anterior.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/27202e2e8721c3b23831563c36ed5ac7818641ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/44fe1efb4961c1a5ccab16bb579dfc6b308ad58b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/737d4d91d35b5f7fa5bb442651472277318b0bfd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/91bb18950b88f955838ec0c1d97f74d135756dc7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a777e06dfc72bed73c05dcb437d7c27ad5f90f3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b1a1743aaa4906c41c426eda97e2e2586f79246d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb0245fa72b783cb23a9949c5048781341e91423\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.