CVE-2025-21921 (GCVE-0-2025-21921)
Vulnerability from cvelistv5
Published
2025-04-01 15:40
Modified
2025-05-04 07:24
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device ethnl_req_get_phydev() is used to lookup a phy_device, in the case an ethtool netlink command targets a specific phydev within a netdev's topology. It takes as a parameter a const struct nlattr *header that's used for error handling : if (!phydev) { NL_SET_ERR_MSG_ATTR(extack, header, "no phy matching phyindex"); return ERR_PTR(-ENODEV); } In the notify path after a ->set operation however, there's no request attributes available. The typical callsite for the above function looks like: phydev = ethnl_req_get_phydev(req_base, tb[ETHTOOL_A_XXX_HEADER], info->extack); So, when tb is NULL (such as in the ethnl notify path), we have a nice crash. It turns out that there's only the PLCA command that is in that case, as the other phydev-specific commands don't have a notification. This commit fixes the crash by passing the cmd index and the nlattr array separately, allowing NULL-checking it directly inside the helper.
References
Impacted products
Vendor Product Version
Linux Linux Version: c15e065b46dc4e19837275b826c1960d55564abd
Version: c15e065b46dc4e19837275b826c1960d55564abd
Version: c15e065b46dc4e19837275b826c1960d55564abd
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/cabletest.c",
            "net/ethtool/linkstate.c",
            "net/ethtool/netlink.c",
            "net/ethtool/netlink.h",
            "net/ethtool/phy.c",
            "net/ethtool/plca.c",
            "net/ethtool/pse-pd.c",
            "net/ethtool/stats.c",
            "net/ethtool/strset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "639c70352958735addbba5ae7dd65985da96e061",
              "status": "affected",
              "version": "c15e065b46dc4e19837275b826c1960d55564abd",
              "versionType": "git"
            },
            {
              "lessThan": "1f458fa42c29144cef280e05bc49fc21b873d897",
              "status": "affected",
              "version": "c15e065b46dc4e19837275b826c1960d55564abd",
              "versionType": "git"
            },
            {
              "lessThan": "637399bf7e77797811adf340090b561a8f9d1213",
              "status": "affected",
              "version": "c15e065b46dc4e19837275b826c1960d55564abd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/cabletest.c",
            "net/ethtool/linkstate.c",
            "net/ethtool/netlink.c",
            "net/ethtool/netlink.h",
            "net/ethtool/phy.c",
            "net/ethtool/plca.c",
            "net/ethtool/pse-pd.c",
            "net/ethtool/stats.c",
            "net/ethtool/strset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.19",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.7",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethtool: netlink: Allow NULL nlattrs when getting a phy_device\n\nethnl_req_get_phydev() is used to lookup a phy_device, in the case an\nethtool netlink command targets a specific phydev within a netdev\u0027s\ntopology.\n\nIt takes as a parameter a const struct nlattr *header that\u0027s used for\nerror handling :\n\n       if (!phydev) {\n               NL_SET_ERR_MSG_ATTR(extack, header,\n                                   \"no phy matching phyindex\");\n               return ERR_PTR(-ENODEV);\n       }\n\nIn the notify path after a -\u003eset operation however, there\u0027s no request\nattributes available.\n\nThe typical callsite for the above function looks like:\n\n\tphydev = ethnl_req_get_phydev(req_base, tb[ETHTOOL_A_XXX_HEADER],\n\t\t\t\t      info-\u003eextack);\n\nSo, when tb is NULL (such as in the ethnl notify path), we have a nice\ncrash.\n\nIt turns out that there\u0027s only the PLCA command that is in that case, as\nthe other phydev-specific commands don\u0027t have a notification.\n\nThis commit fixes the crash by passing the cmd index and the nlattr\narray separately, allowing NULL-checking it directly inside the helper."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:24:36.169Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/639c70352958735addbba5ae7dd65985da96e061"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f458fa42c29144cef280e05bc49fc21b873d897"
        },
        {
          "url": "https://git.kernel.org/stable/c/637399bf7e77797811adf340090b561a8f9d1213"
        }
      ],
      "title": "net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21921",
    "datePublished": "2025-04-01T15:40:55.110Z",
    "dateReserved": "2024-12-29T08:45:45.788Z",
    "dateUpdated": "2025-05-04T07:24:36.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21921\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:22.790\",\"lastModified\":\"2025-04-01T20:26:01.990\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ethtool: netlink: Allow NULL nlattrs when getting a phy_device\\n\\nethnl_req_get_phydev() is used to lookup a phy_device, in the case an\\nethtool netlink command targets a specific phydev within a netdev\u0027s\\ntopology.\\n\\nIt takes as a parameter a const struct nlattr *header that\u0027s used for\\nerror handling :\\n\\n       if (!phydev) {\\n               NL_SET_ERR_MSG_ATTR(extack, header,\\n                                   \\\"no phy matching phyindex\\\");\\n               return ERR_PTR(-ENODEV);\\n       }\\n\\nIn the notify path after a -\u003eset operation however, there\u0027s no request\\nattributes available.\\n\\nThe typical callsite for the above function looks like:\\n\\n\\tphydev = ethnl_req_get_phydev(req_base, tb[ETHTOOL_A_XXX_HEADER],\\n\\t\\t\\t\\t      info-\u003eextack);\\n\\nSo, when tb is NULL (such as in the ethnl notify path), we have a nice\\ncrash.\\n\\nIt turns out that there\u0027s only the PLCA command that is in that case, as\\nthe other phydev-specific commands don\u0027t have a notification.\\n\\nThis commit fixes the crash by passing the cmd index and the nlattr\\narray separately, allowing NULL-checking it directly inside the helper.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ethtool: netlink: Permite nlattrs nulos al obtener un phy_device. ethnl_req_get_phydev() se usa para buscar un phy_device si el comando netlink de ethtool apunta a un phydev espec\u00edfico dentro de la topolog\u00eda de un netdev. Toma como par\u00e1metro una constante struct nlattr *header que se usa para la gesti\u00f3n de errores: if (!phydev) { NL_SET_ERR_MSG_ATTR(extack, header, \\\"no phy matches phyindex\\\"); return ERR_PTR(-ENODEV); } Sin embargo, en la ruta de notificaci\u00f3n despu\u00e9s de una operaci\u00f3n -\u0026gt;set, no hay atributos de solicitud disponibles. El sitio de llamada t\u00edpico para la funci\u00f3n anterior se ve as\u00ed: phydev = ethnl_req_get_phydev(req_base, tb[ETHTOOL_A_XXX_HEADER], info-\u0026gt;extack); Por lo tanto, cuando tb es nulo (como en la ruta de notificaci\u00f3n de ethnl), se produce un fallo. Resulta que solo el comando PLCA se encuentra en ese caso, ya que los dem\u00e1s comandos espec\u00edficos de phydev no tienen notificaci\u00f3n. Esta confirmaci\u00f3n corrige el fallo pasando el \u00edndice cmd y la matriz nlattr por separado, lo que permite comprobar su estado nulo directamente dentro del asistente.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1f458fa42c29144cef280e05bc49fc21b873d897\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/637399bf7e77797811adf340090b561a8f9d1213\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/639c70352958735addbba5ae7dd65985da96e061\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.