CVE-2025-21777 (GCVE-0-2025-21777)
Vulnerability from cvelistv5
Published
2025-02-27 02:18
Modified
2025-05-04 07:20
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Validate the persistent meta data subbuf array The meta data for a mapped ring buffer contains an array of indexes of all the subbuffers. The first entry is the reader page, and the rest of the entries lay out the order of the subbuffers in how the ring buffer link list is to be created. The validator currently makes sure that all the entries are within the range of 0 and nr_subbufs. But it does not check if there are any duplicates. While working on the ring buffer, I corrupted this array, where I added duplicates. The validator did not catch it and created the ring buffer link list on top of it. Luckily, the corruption was only that the reader page was also in the writer path and only presented corrupted data but did not crash the kernel. But if there were duplicates in the writer side, then it could corrupt the ring buffer link list and cause a crash. Create a bitmask array with the size of the number of subbuffers. Then clear it. When walking through the subbuf array checking to see if the entries are within the range, test if its bit is already set in the subbuf_mask. If it is, then there is duplicates and fail the validation. If not, set the corresponding bit and continue.
References
Impacted products
Vendor Product Version
Linux Linux Version: c76883f18e59b762247ee91d3e4224231711854e
Version: c76883f18e59b762247ee91d3e4224231711854e
Version: c76883f18e59b762247ee91d3e4224231711854e
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ec743d558f111d8999aea24577ba66c65ee2eeb",
              "status": "affected",
              "version": "c76883f18e59b762247ee91d3e4224231711854e",
              "versionType": "git"
            },
            {
              "lessThan": "0d547a6f5e8fad26ebc12f501d7d19fccdbad6bf",
              "status": "affected",
              "version": "c76883f18e59b762247ee91d3e4224231711854e",
              "versionType": "git"
            },
            {
              "lessThan": "f5b95f1fa2ef3a03f49eeec658ba97e721412b32",
              "status": "affected",
              "version": "c76883f18e59b762247ee91d3e4224231711854e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Validate the persistent meta data subbuf array\n\nThe meta data for a mapped ring buffer contains an array of indexes of all\nthe subbuffers. The first entry is the reader page, and the rest of the\nentries lay out the order of the subbuffers in how the ring buffer link\nlist is to be created.\n\nThe validator currently makes sure that all the entries are within the\nrange of 0 and nr_subbufs. But it does not check if there are any\nduplicates.\n\nWhile working on the ring buffer, I corrupted this array, where I added\nduplicates. The validator did not catch it and created the ring buffer\nlink list on top of it. Luckily, the corruption was only that the reader\npage was also in the writer path and only presented corrupted data but did\nnot crash the kernel. But if there were duplicates in the writer side,\nthen it could corrupt the ring buffer link list and cause a crash.\n\nCreate a bitmask array with the size of the number of subbuffers. Then\nclear it. When walking through the subbuf array checking to see if the\nentries are within the range, test if its bit is already set in the\nsubbuf_mask. If it is, then there is duplicates and fail the validation.\nIf not, set the corresponding bit and continue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:20:57.840Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ec743d558f111d8999aea24577ba66c65ee2eeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d547a6f5e8fad26ebc12f501d7d19fccdbad6bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5b95f1fa2ef3a03f49eeec658ba97e721412b32"
        }
      ],
      "title": "ring-buffer: Validate the persistent meta data subbuf array",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21777",
    "datePublished": "2025-02-27T02:18:22.008Z",
    "dateReserved": "2024-12-29T08:45:45.763Z",
    "dateUpdated": "2025-05-04T07:20:57.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21777\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T03:15:18.377\",\"lastModified\":\"2025-02-27T03:15:18.377\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nring-buffer: Validate the persistent meta data subbuf array\\n\\nThe meta data for a mapped ring buffer contains an array of indexes of all\\nthe subbuffers. The first entry is the reader page, and the rest of the\\nentries lay out the order of the subbuffers in how the ring buffer link\\nlist is to be created.\\n\\nThe validator currently makes sure that all the entries are within the\\nrange of 0 and nr_subbufs. But it does not check if there are any\\nduplicates.\\n\\nWhile working on the ring buffer, I corrupted this array, where I added\\nduplicates. The validator did not catch it and created the ring buffer\\nlink list on top of it. Luckily, the corruption was only that the reader\\npage was also in the writer path and only presented corrupted data but did\\nnot crash the kernel. But if there were duplicates in the writer side,\\nthen it could corrupt the ring buffer link list and cause a crash.\\n\\nCreate a bitmask array with the size of the number of subbuffers. Then\\nclear it. When walking through the subbuf array checking to see if the\\nentries are within the range, test if its bit is already set in the\\nsubbuf_mask. If it is, then there is duplicates and fail the validation.\\nIf not, set the corresponding bit and continue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ring-buffer: validar la matriz de subbuf de metadatos persistentes Los metadatos de un b\u00fafer de anillo asignado contienen una matriz de \u00edndices de todos los subb\u00faferes. La primera entrada es la p\u00e1gina del lector y el resto de las entradas establecen el orden de los subb\u00faferes en c\u00f3mo se crear\u00e1 la lista de enlaces del b\u00fafer de anillo. El validador actualmente se asegura de que todas las entradas est\u00e9n dentro del rango de 0 y nr_subbufs. Pero no verifica si hay duplicados. Mientras trabajaba en el b\u00fafer de anillo, corromp\u00ed esta matriz, donde agregu\u00e9 duplicados. El validador no lo detect\u00f3 y cre\u00f3 la lista de enlaces del b\u00fafer de anillo encima. Afortunadamente, la corrupci\u00f3n fue solo que la p\u00e1gina del lector tambi\u00e9n estaba en la ruta del escritor y solo present\u00f3 datos corruptos pero no bloque\u00f3 el kernel. Pero si hab\u00eda duplicados en el lado del escritor, entonces podr\u00eda corromper la lista de enlaces del b\u00fafer de anillo y causar un bloqueo. Cree una matriz de m\u00e1scara de bits con el tama\u00f1o del n\u00famero de subb\u00faferes. Luego, b\u00f3rrelo. Al recorrer la matriz subbuf para verificar si las entradas est\u00e1n dentro del rango, verifique si su bit ya est\u00e1 configurado en subbuf_mask. Si es as\u00ed, entonces hay duplicados y falla la validaci\u00f3n. Si no es as\u00ed, configure el bit correspondiente y contin\u00fae.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d547a6f5e8fad26ebc12f501d7d19fccdbad6bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3ec743d558f111d8999aea24577ba66c65ee2eeb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f5b95f1fa2ef3a03f49eeec658ba97e721412b32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.