CVE-2025-37959 (GCVE-0-2025-37959)
Vulnerability from cvelistv5
Published
2025-05-20 16:01
Modified
2025-05-26 05:24
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another namespace. As one example, this is causing Cilium to drop traffic when using bpf_redirect_peer to redirect packets that just went through IPsec decryption to a container namespace. The following pwru trace shows (1) the packet path from the host's XFRM layer to the container's XFRM layer where it's dropped and (2) the number of active skb extensions at each function. NETNS MARK IFACE TUPLE FUNC 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm_rcv_cb .active_extensions = (__u8)2, 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm4_rcv_cb .active_extensions = (__u8)2, 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 gro_cells_receive .active_extensions = (__u8)2, [...] 4026533547 0 eth0 10.244.3.124:35473->10.244.2.158:53 skb_do_redirect .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 ip_rcv .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 ip_rcv_core .active_extensions = (__u8)2, [...] 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 udp_queue_rcv_one_skb .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 __xfrm_policy_check .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 __xfrm_decode_session .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 security_xfrm_decode_session .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 kfree_skb_reason(SKB_DROP_REASON_XFRM_POLICY) .active_extensions = (__u8)2, In this case, there are no XFRM policies in the container's network namespace so the drop is unexpected. When we decrypt the IPsec packet, the XFRM state used for decryption is set in the skb extensions. This information is preserved across the netns switch. When we reach the XFRM policy check in the container's netns, __xfrm_policy_check drops the packet with LINUX_MIB_XFRMINNOPOLS because a (container-side) XFRM policy can't be found that matches the (host-side) XFRM state used for decryption. This patch fixes this by scrubbing the packet when using bpf_redirect_peer, as is done on typical netns switches via veth devices except skb->mark and skb->tstamp are not zeroed.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9aa1206e8f48222f35a0c809f33b2f4aaa1e2661
Version: 9aa1206e8f48222f35a0c809f33b2f4aaa1e2661
Version: 9aa1206e8f48222f35a0c809f33b2f4aaa1e2661
Version: 9aa1206e8f48222f35a0c809f33b2f4aaa1e2661
Version: 9aa1206e8f48222f35a0c809f33b2f4aaa1e2661
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "de1067cc8cf0e8c11ae20cbe5c467aef19d04ded",
              "status": "affected",
              "version": "9aa1206e8f48222f35a0c809f33b2f4aaa1e2661",
              "versionType": "git"
            },
            {
              "lessThan": "355b0526336c0bf2bf7feaca033568ede524f763",
              "status": "affected",
              "version": "9aa1206e8f48222f35a0c809f33b2f4aaa1e2661",
              "versionType": "git"
            },
            {
              "lessThan": "b37e54259cab4f78b53953d6f6268b85f07bef3e",
              "status": "affected",
              "version": "9aa1206e8f48222f35a0c809f33b2f4aaa1e2661",
              "versionType": "git"
            },
            {
              "lessThan": "9e15ef33ba39fb6d9d1f51445957f16983a9437a",
              "status": "affected",
              "version": "9aa1206e8f48222f35a0c809f33b2f4aaa1e2661",
              "versionType": "git"
            },
            {
              "lessThan": "c4327229948879814229b46aa26a750718888503",
              "status": "affected",
              "version": "9aa1206e8f48222f35a0c809f33b2f4aaa1e2661",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.139",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.139",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.91",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.29",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.7",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Scrub packet on bpf_redirect_peer\n\nWhen bpf_redirect_peer is used to redirect packets to a device in\nanother network namespace, the skb isn\u0027t scrubbed. That can lead skb\ninformation from one namespace to be \"misused\" in another namespace.\n\nAs one example, this is causing Cilium to drop traffic when using\nbpf_redirect_peer to redirect packets that just went through IPsec\ndecryption to a container namespace. The following pwru trace shows (1)\nthe packet path from the host\u0027s XFRM layer to the container\u0027s XFRM\nlayer where it\u0027s dropped and (2) the number of active skb extensions at\neach function.\n\n    NETNS       MARK  IFACE  TUPLE                                FUNC\n    4026533547  d00   eth0   10.244.3.124:35473-\u003e10.244.2.158:53  xfrm_rcv_cb\n                             .active_extensions = (__u8)2,\n    4026533547  d00   eth0   10.244.3.124:35473-\u003e10.244.2.158:53  xfrm4_rcv_cb\n                             .active_extensions = (__u8)2,\n    4026533547  d00   eth0   10.244.3.124:35473-\u003e10.244.2.158:53  gro_cells_receive\n                             .active_extensions = (__u8)2,\n    [...]\n    4026533547  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  skb_do_redirect\n                             .active_extensions = (__u8)2,\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  ip_rcv\n                             .active_extensions = (__u8)2,\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  ip_rcv_core\n                             .active_extensions = (__u8)2,\n    [...]\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  udp_queue_rcv_one_skb\n                             .active_extensions = (__u8)2,\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  __xfrm_policy_check\n                             .active_extensions = (__u8)2,\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  __xfrm_decode_session\n                             .active_extensions = (__u8)2,\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  security_xfrm_decode_session\n                             .active_extensions = (__u8)2,\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  kfree_skb_reason(SKB_DROP_REASON_XFRM_POLICY)\n                             .active_extensions = (__u8)2,\n\nIn this case, there are no XFRM policies in the container\u0027s network\nnamespace so the drop is unexpected. When we decrypt the IPsec packet,\nthe XFRM state used for decryption is set in the skb extensions. This\ninformation is preserved across the netns switch. When we reach the\nXFRM policy check in the container\u0027s netns, __xfrm_policy_check drops\nthe packet with LINUX_MIB_XFRMINNOPOLS because a (container-side) XFRM\npolicy can\u0027t be found that matches the (host-side) XFRM state used for\ndecryption.\n\nThis patch fixes this by scrubbing the packet when using\nbpf_redirect_peer, as is done on typical netns switches via veth\ndevices except skb-\u003emark and skb-\u003etstamp are not zeroed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T05:24:35.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/de1067cc8cf0e8c11ae20cbe5c467aef19d04ded"
        },
        {
          "url": "https://git.kernel.org/stable/c/355b0526336c0bf2bf7feaca033568ede524f763"
        },
        {
          "url": "https://git.kernel.org/stable/c/b37e54259cab4f78b53953d6f6268b85f07bef3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e15ef33ba39fb6d9d1f51445957f16983a9437a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4327229948879814229b46aa26a750718888503"
        }
      ],
      "title": "bpf: Scrub packet on bpf_redirect_peer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37959",
    "datePublished": "2025-05-20T16:01:52.547Z",
    "dateReserved": "2025-04-16T04:51:23.974Z",
    "dateUpdated": "2025-05-26T05:24:35.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37959\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:34.143\",\"lastModified\":\"2025-05-21T20:24:58.133\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Scrub packet on bpf_redirect_peer\\n\\nWhen bpf_redirect_peer is used to redirect packets to a device in\\nanother network namespace, the skb isn\u0027t scrubbed. That can lead skb\\ninformation from one namespace to be \\\"misused\\\" in another namespace.\\n\\nAs one example, this is causing Cilium to drop traffic when using\\nbpf_redirect_peer to redirect packets that just went through IPsec\\ndecryption to a container namespace. The following pwru trace shows (1)\\nthe packet path from the host\u0027s XFRM layer to the container\u0027s XFRM\\nlayer where it\u0027s dropped and (2) the number of active skb extensions at\\neach function.\\n\\n    NETNS       MARK  IFACE  TUPLE                                FUNC\\n    4026533547  d00   eth0   10.244.3.124:35473-\u003e10.244.2.158:53  xfrm_rcv_cb\\n                             .active_extensions = (__u8)2,\\n    4026533547  d00   eth0   10.244.3.124:35473-\u003e10.244.2.158:53  xfrm4_rcv_cb\\n                             .active_extensions = (__u8)2,\\n    4026533547  d00   eth0   10.244.3.124:35473-\u003e10.244.2.158:53  gro_cells_receive\\n                             .active_extensions = (__u8)2,\\n    [...]\\n    4026533547  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  skb_do_redirect\\n                             .active_extensions = (__u8)2,\\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  ip_rcv\\n                             .active_extensions = (__u8)2,\\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  ip_rcv_core\\n                             .active_extensions = (__u8)2,\\n    [...]\\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  udp_queue_rcv_one_skb\\n                             .active_extensions = (__u8)2,\\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  __xfrm_policy_check\\n                             .active_extensions = (__u8)2,\\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  __xfrm_decode_session\\n                             .active_extensions = (__u8)2,\\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  security_xfrm_decode_session\\n                             .active_extensions = (__u8)2,\\n    4026534999  0     eth0   10.244.3.124:35473-\u003e10.244.2.158:53  kfree_skb_reason(SKB_DROP_REASON_XFRM_POLICY)\\n                             .active_extensions = (__u8)2,\\n\\nIn this case, there are no XFRM policies in the container\u0027s network\\nnamespace so the drop is unexpected. When we decrypt the IPsec packet,\\nthe XFRM state used for decryption is set in the skb extensions. This\\ninformation is preserved across the netns switch. When we reach the\\nXFRM policy check in the container\u0027s netns, __xfrm_policy_check drops\\nthe packet with LINUX_MIB_XFRMINNOPOLS because a (container-side) XFRM\\npolicy can\u0027t be found that matches the (host-side) XFRM state used for\\ndecryption.\\n\\nThis patch fixes this by scrubbing the packet when using\\nbpf_redirect_peer, as is done on typical netns switches via veth\\ndevices except skb-\u003emark and skb-\u003etstamp are not zeroed.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Depuraci\u00f3n de paquetes en bpf_redirect_peer. Cuando se usa bpf_redirect_peer para redirigir paquetes a un dispositivo en otro espacio de nombres de red, el skb no se depura. Esto puede provocar que la informaci\u00f3n de skb de un espacio de nombres se utilice indebidamente en otro. Por ejemplo, esto provoca que Cilium descarte tr\u00e1fico al usar bpf_redirect_peer para redirigir paquetes que acaban de pasar por el descifrado de IPsec a un espacio de nombres de contenedor. El siguiente seguimiento de pwru muestra (1) la ruta del paquete desde la capa XFRM del host hasta la capa XFRM del contenedor, donde se descarta, y (2) el n\u00famero de extensiones skb activas en cada funci\u00f3n. NETNS MARK IFACE TUPLE FUNC 4026533547 d00 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 xfrm_rcv_cb .active_extensions = (__u8)2, 4026533547 d00 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 xfrm4_rcv_cb .active_extensions = (__u8)2, 4026533547 d00 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 gro_cells_receive .active_extensions = (__u8)2, [...] 4026533547 0 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 skb_do_redirect .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 ip_rcv .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 ip_rcv_core .active_extensions = (__u8)2, [...] 4026534999 0 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 udp_queue_rcv_one_skb .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 __xfrm_policy_check .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 __xfrm_decode_session .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 security_xfrm_decode_session .active_extensions = (__u8)2, 4026534999 0 eth0 10.244.3.124:35473-\u0026gt;10.244.2.158:53 kfree_skb_reason(SKB_DROP_REASON_XFRM_POLICY) .active_extensions = (__u8)2. En este caso, no hay pol\u00edticas XFRM en el espacio de nombres de red del contenedor, por lo que la p\u00e9rdida es inesperada. Al descifrar el paquete IPsec, el estado XFRM utilizado para el descifrado se configura en las extensiones skb. Esta informaci\u00f3n se conserva en el conmutador netns. Al llegar a la comprobaci\u00f3n de la pol\u00edtica XFRM en las redes netn del contenedor, __xfrm_policy_check descarta el paquete con LINUX_MIB_XFRMINNOPOLS porque no se encuentra una pol\u00edtica XFRM (del lado del contenedor) que coincida con el estado XFRM (del lado del host) utilizado para el descifrado. Este parche corrige este problema depurando el paquete al usar bpf_redirect_peer, como se hace en conmutadores netn t\u00edpicos a trav\u00e9s de dispositivos veth, excepto que skb-\u0026gt;mark y skb-\u0026gt;tstamp no se ponen a cero.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/355b0526336c0bf2bf7feaca033568ede524f763\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e15ef33ba39fb6d9d1f51445957f16983a9437a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b37e54259cab4f78b53953d6f6268b85f07bef3e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c4327229948879814229b46aa26a750718888503\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/de1067cc8cf0e8c11ae20cbe5c467aef19d04ded\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.