CVE-2025-21681 (GCVE-0-2025-21681)
Vulnerability from cvelistv5
Published
2025-01-31 11:25
Modified
2025-05-04 13:06
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix lockup on tx to unregistering netdev with carrier Commit in a fixes tag attempted to fix the issue in the following sequence of calls: do_output -> ovs_vport_send -> dev_queue_xmit -> __dev_queue_xmit -> netdev_core_pick_tx -> skb_tx_hash When device is unregistering, the 'dev->real_num_tx_queues' goes to zero and the 'while (unlikely(hash >= qcount))' loop inside the 'skb_tx_hash' becomes infinite, locking up the core forever. But unfortunately, checking just the carrier status is not enough to fix the issue, because some devices may still be in unregistering state while reporting carrier status OK. One example of such device is a net/dummy. It sets carrier ON on start, but it doesn't implement .ndo_stop to set the carrier off. And it makes sense, because dummy doesn't really have a carrier. Therefore, while this device is unregistering, it's still easy to hit the infinite loop in the skb_tx_hash() from the OVS datapath. There might be other drivers that do the same, but dummy by itself is important for the OVS ecosystem, because it is frequently used as a packet sink for tcpdump while debugging OVS deployments. And when the issue is hit, the only way to recover is to reboot. Fix that by also checking if the device is running. The running state is handled by the net core during unregistering, so it covers unregistering case better, and we don't really need to send packets to devices that are not running anyway. While only checking the running state might be enough, the carrier check is preserved. The running and the carrier states seem disjoined throughout the code and different drivers. And other core functions like __dev_direct_xmit() check both before attempting to transmit a packet. So, it seems safer to check both flags in OVS as well.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9b0dd09c1ceb35950d2884848099fccc9ec9a123
Version: 284be5db6c8d06d247ed056cfc448c4f79bbb16c
Version: 5efcb301523baacd98a47553d4996e924923114d
Version: 644b3051b06ba465bc7401bfae9b14963cbc8c1c
Version: 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8
Version: 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8
Version: 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8
Version: 56252da41426f3d01957456f13caf46ce670ea29
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/actions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092",
              "status": "affected",
              "version": "9b0dd09c1ceb35950d2884848099fccc9ec9a123",
              "versionType": "git"
            },
            {
              "lessThan": "87fcf0d137c770e6040ebfdb0abd8e7dd481b504",
              "status": "affected",
              "version": "284be5db6c8d06d247ed056cfc448c4f79bbb16c",
              "versionType": "git"
            },
            {
              "lessThan": "930268823f6bccb697aa5d2047aeffd4a497308c",
              "status": "affected",
              "version": "5efcb301523baacd98a47553d4996e924923114d",
              "versionType": "git"
            },
            {
              "lessThan": "ea9e990356b7bee95440ba0e6e83cc4d701afaca",
              "status": "affected",
              "version": "644b3051b06ba465bc7401bfae9b14963cbc8c1c",
              "versionType": "git"
            },
            {
              "lessThan": "ea966b6698785fb9cd0fdb867acd91b222e4723f",
              "status": "affected",
              "version": "066b86787fa3d97b7aefb5ac0a99a22dad2d15f8",
              "versionType": "git"
            },
            {
              "lessThan": "82f433e8dd0629e16681edf6039d094b5518d8ed",
              "status": "affected",
              "version": "066b86787fa3d97b7aefb5ac0a99a22dad2d15f8",
              "versionType": "git"
            },
            {
              "lessThan": "47e55e4b410f7d552e43011baa5be1aab4093990",
              "status": "affected",
              "version": "066b86787fa3d97b7aefb5ac0a99a22dad2d15f8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "56252da41426f3d01957456f13caf46ce670ea29",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/actions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.127",
                  "versionStartIncluding": "6.1.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.74",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix lockup on tx to unregistering netdev with carrier\n\nCommit in a fixes tag attempted to fix the issue in the following\nsequence of calls:\n\n    do_output\n    -\u003e ovs_vport_send\n       -\u003e dev_queue_xmit\n          -\u003e __dev_queue_xmit\n             -\u003e netdev_core_pick_tx\n                -\u003e skb_tx_hash\n\nWhen device is unregistering, the \u0027dev-\u003ereal_num_tx_queues\u0027 goes to\nzero and the \u0027while (unlikely(hash \u003e= qcount))\u0027 loop inside the\n\u0027skb_tx_hash\u0027 becomes infinite, locking up the core forever.\n\nBut unfortunately, checking just the carrier status is not enough to\nfix the issue, because some devices may still be in unregistering\nstate while reporting carrier status OK.\n\nOne example of such device is a net/dummy.  It sets carrier ON\non start, but it doesn\u0027t implement .ndo_stop to set the carrier off.\nAnd it makes sense, because dummy doesn\u0027t really have a carrier.\nTherefore, while this device is unregistering, it\u0027s still easy to hit\nthe infinite loop in the skb_tx_hash() from the OVS datapath.  There\nmight be other drivers that do the same, but dummy by itself is\nimportant for the OVS ecosystem, because it is frequently used as a\npacket sink for tcpdump while debugging OVS deployments.  And when the\nissue is hit, the only way to recover is to reboot.\n\nFix that by also checking if the device is running.  The running\nstate is handled by the net core during unregistering, so it covers\nunregistering case better, and we don\u0027t really need to send packets\nto devices that are not running anyway.\n\nWhile only checking the running state might be enough, the carrier\ncheck is preserved.  The running and the carrier states seem disjoined\nthroughout the code and different drivers.  And other core functions\nlike __dev_direct_xmit() check both before attempting to transmit\na packet.  So, it seems safer to check both flags in OVS as well."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T13:06:16.064Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092"
        },
        {
          "url": "https://git.kernel.org/stable/c/87fcf0d137c770e6040ebfdb0abd8e7dd481b504"
        },
        {
          "url": "https://git.kernel.org/stable/c/930268823f6bccb697aa5d2047aeffd4a497308c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea9e990356b7bee95440ba0e6e83cc4d701afaca"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea966b6698785fb9cd0fdb867acd91b222e4723f"
        },
        {
          "url": "https://git.kernel.org/stable/c/82f433e8dd0629e16681edf6039d094b5518d8ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/47e55e4b410f7d552e43011baa5be1aab4093990"
        }
      ],
      "title": "openvswitch: fix lockup on tx to unregistering netdev with carrier",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21681",
    "datePublished": "2025-01-31T11:25:41.491Z",
    "dateReserved": "2024-12-29T08:45:45.739Z",
    "dateUpdated": "2025-05-04T13:06:16.064Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21681\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-31T12:15:29.260\",\"lastModified\":\"2025-05-02T07:15:58.793\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nopenvswitch: fix lockup on tx to unregistering netdev with carrier\\n\\nCommit in a fixes tag attempted to fix the issue in the following\\nsequence of calls:\\n\\n    do_output\\n    -\u003e ovs_vport_send\\n       -\u003e dev_queue_xmit\\n          -\u003e __dev_queue_xmit\\n             -\u003e netdev_core_pick_tx\\n                -\u003e skb_tx_hash\\n\\nWhen device is unregistering, the \u0027dev-\u003ereal_num_tx_queues\u0027 goes to\\nzero and the \u0027while (unlikely(hash \u003e= qcount))\u0027 loop inside the\\n\u0027skb_tx_hash\u0027 becomes infinite, locking up the core forever.\\n\\nBut unfortunately, checking just the carrier status is not enough to\\nfix the issue, because some devices may still be in unregistering\\nstate while reporting carrier status OK.\\n\\nOne example of such device is a net/dummy.  It sets carrier ON\\non start, but it doesn\u0027t implement .ndo_stop to set the carrier off.\\nAnd it makes sense, because dummy doesn\u0027t really have a carrier.\\nTherefore, while this device is unregistering, it\u0027s still easy to hit\\nthe infinite loop in the skb_tx_hash() from the OVS datapath.  There\\nmight be other drivers that do the same, but dummy by itself is\\nimportant for the OVS ecosystem, because it is frequently used as a\\npacket sink for tcpdump while debugging OVS deployments.  And when the\\nissue is hit, the only way to recover is to reboot.\\n\\nFix that by also checking if the device is running.  The running\\nstate is handled by the net core during unregistering, so it covers\\nunregistering case better, and we don\u0027t really need to send packets\\nto devices that are not running anyway.\\n\\nWhile only checking the running state might be enough, the carrier\\ncheck is preserved.  The running and the carrier states seem disjoined\\nthroughout the code and different drivers.  And other core functions\\nlike __dev_direct_xmit() check both before attempting to transmit\\na packet.  So, it seems safer to check both flags in OVS as well.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: openvswitch: fix lockup on tx to unregistering netdev with carrier Commit en una etiqueta fixes intent\u00f3 solucionar el problema en la siguiente secuencia de llamadas: do_output -\u0026gt; ovs_vport_send -\u0026gt; dev_queue_xmit -\u0026gt; __dev_queue_xmit -\u0026gt; netdev_core_pick_tx -\u0026gt; skb_tx_hash Cuando el dispositivo est\u00e1 anulando el registro, \u0027dev-\u0026gt;real_num_tx_queues\u0027 va a cero y el bucle \u0027while (unlikely(hash \u0026gt;= qcount))\u0027 dentro de \u0027skb_tx_hash\u0027 se vuelve infinito, bloqueando el n\u00facleo para siempre. Pero desafortunadamente, verificar solo el estado del operador no es suficiente para solucionar el problema, porque algunos dispositivos a\u00fan pueden estar en estado de anulaci\u00f3n de registro mientras informan que el estado del operador es correcto. Un ejemplo de dicho dispositivo es un net/dummy. Activa el operador al iniciar, pero no implementa .ndo_stop para desactivarlo. Y tiene sentido, porque dummy en realidad no tiene un operador. Por lo tanto, mientras este dispositivo se est\u00e1 anulando el registro, sigue siendo f\u00e1cil alcanzar el bucle infinito en skb_tx_hash() desde la ruta de datos de OVS. Puede haber otros controladores que hagan lo mismo, pero dummy por s\u00ed solo es importante para el ecosistema OVS, porque se usa con frecuencia como un receptor de paquetes para tcpdump mientras se depuran las implementaciones de OVS. Y cuando se produce el problema, la \u00fanica forma de recuperarse es reiniciar. Solucione eso comprobando tambi\u00e9n si el dispositivo est\u00e1 en ejecuci\u00f3n. El estado de ejecuci\u00f3n controla el n\u00facleo de red durante la anulaci\u00f3n del registro, por lo que cubre mejor el caso de anulaci\u00f3n del registro y realmente no necesitamos enviar paquetes a dispositivos que no se est\u00e1n ejecutando de todos modos. Si bien solo comprobar el estado de ejecuci\u00f3n puede ser suficiente, la comprobaci\u00f3n del operador se conserva. Los estados de ejecuci\u00f3n y del operador parecen estar separados en todo el c\u00f3digo y en los diferentes controladores. Y otras funciones b\u00e1sicas como __dev_direct_xmit() comprueban ambos antes de intentar transmitir un paquete. Por lo tanto, parece m\u00e1s seguro comprobar tambi\u00e9n ambos indicadores en OVS.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.25\",\"versionEndExcluding\":\"6.1.127\",\"matchCriteriaId\":\"D40EAF88-F300-4CBF-8C2F-CD9CCE985D18\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2.12\",\"versionEndExcluding\":\"6.6.74\",\"matchCriteriaId\":\"66EDD4B5-2C3A-4A8E-AE60-49C429BCB3E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.11\",\"matchCriteriaId\":\"B7D0DBC3-F63C-4396-8A47-6F3D4FA0556E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DFCDFB8-4FD0-465A-9076-D813D78FE51B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/47e55e4b410f7d552e43011baa5be1aab4093990\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82f433e8dd0629e16681edf6039d094b5518d8ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/87fcf0d137c770e6040ebfdb0abd8e7dd481b504\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/930268823f6bccb697aa5d2047aeffd4a497308c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b5c73fc92f8d15c16e5dc87b5c17d2abf1e6d092\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea966b6698785fb9cd0fdb867acd91b222e4723f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ea9e990356b7bee95440ba0e6e83cc4d701afaca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.