From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 149E42441B0 for ; Mon, 10 Feb 2025 15:59:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739203163; cv=none; b=PvR3jsCbu/nAGTM5m1N0XcYpvfdRm81wY8c0OR6IDg9Dh+APhI+lHKJRa5Da3su53KwAS6/M8P+n8x04DTDXqMFLfqFBUBr7HvTGlGwwGJhvDHS8Cj/P5hwfBbkJyFnV0zCbNEwte+Ml2VnnvAUUajV2pk8qejfA0x+BTabbrQQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739203163; c=relaxed/simple; bh=nQ0pp1Le21VBYud03tVrMWJeQ76WXdftOtd2jw7TSJs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ndjjZ6i1eokodESCPjQUN9njAcrNLhylOVRMq12Pg/36mpkkUue+q89yup43CRe+umR8ZudPCwacyURj/nCn6Z+jcmqdIgqa0LIwJM8t1wCfCM14wmGhsHa8aDFgYQrW3rTDQVifM+U+/bIYhigawqp64zi3NJPyKpXTmlDr8mw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Zs4sv9T7; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Zs4sv9T7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A319C4CEE5; Mon, 10 Feb 2025 15:59:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1739203162; bh=nQ0pp1Le21VBYud03tVrMWJeQ76WXdftOtd2jw7TSJs=; h=From:To:Cc:Subject:Date:Reply-to:From; b=Zs4sv9T7ntY0AHKBfIhYV/AsbFSyBxHvY2dAQVOQgquqQZXDDLbrezLV1+aPPurnT RX0dMc6TNxNs7sdTtxK2j0cQ9D9eE7J4PgmvDhC7xlVxonGIxwdVHRZSAd/9FWC7DQ uUe3VLd7TJ8qF8d5Is0+fGujmZwnFKnWv9WtCXAA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-21692: net: sched: fix ets qdisc OOB Indexing Date: Mon, 10 Feb 2025 16:59:00 +0100 Message-ID: <2025021056-CVE-2025-21692-9c7f@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=6050; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=nQ0pp1Le21VBYud03tVrMWJeQ76WXdftOtd2jw7TSJs=; b=owGbwMvMwCRo6H6F97bub03G02pJDOmrlBzcl74+OCvngoPUbL89KsE7jX197N1Tjz2aZXz7d g1DucXqjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjIgqkM89QDNMM+7fXKuRxS acjML8I6/3t6AsOC1Y/mmshsaXzxsUzS1nW3UNiBF8peAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The overflow may cause local privilege escalation. [ 18.852298] ------------[ cut here ]------------ [ 18.853271] UBSAN: array-index-out-of-bounds in net/sched/sch_ets.c:93:20 [ 18.853743] index 18446744073709551615 is out of range for type 'ets_class [16]' [ 18.854254] CPU: 0 UID: 0 PID: 1275 Comm: poc Not tainted 6.12.6-dirty #17 [ 18.854821] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 18.856532] Call Trace: [ 18.857441] [ 18.858227] dump_stack_lvl+0xc2/0xf0 [ 18.859607] dump_stack+0x10/0x20 [ 18.860908] __ubsan_handle_out_of_bounds+0xa7/0xf0 [ 18.864022] ets_class_change+0x3d6/0x3f0 [ 18.864322] tc_ctl_tclass+0x251/0x910 [ 18.864587] ? lock_acquire+0x5e/0x140 [ 18.865113] ? __mutex_lock+0x9c/0xe70 [ 18.866009] ? __mutex_lock+0xa34/0xe70 [ 18.866401] rtnetlink_rcv_msg+0x170/0x6f0 [ 18.866806] ? __lock_acquire+0x578/0xc10 [ 18.867184] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 18.867503] netlink_rcv_skb+0x59/0x110 [ 18.867776] rtnetlink_rcv+0x15/0x30 [ 18.868159] netlink_unicast+0x1c3/0x2b0 [ 18.868440] netlink_sendmsg+0x239/0x4b0 [ 18.868721] ____sys_sendmsg+0x3e2/0x410 [ 18.869012] ___sys_sendmsg+0x88/0xe0 [ 18.869276] ? rseq_ip_fixup+0x198/0x260 [ 18.869563] ? rseq_update_cpu_node_id+0x10a/0x190 [ 18.869900] ? trace_hardirqs_off+0x5a/0xd0 [ 18.870196] ? syscall_exit_to_user_mode+0xcc/0x220 [ 18.870547] ? do_syscall_64+0x93/0x150 [ 18.870821] ? __memcg_slab_free_hook+0x69/0x290 [ 18.871157] __sys_sendmsg+0x69/0xd0 [ 18.871416] __x64_sys_sendmsg+0x1d/0x30 [ 18.871699] x64_sys_call+0x9e2/0x2670 [ 18.871979] do_syscall_64+0x87/0x150 [ 18.873280] ? do_syscall_64+0x93/0x150 [ 18.874742] ? lock_release+0x7b/0x160 [ 18.876157] ? do_user_addr_fault+0x5ce/0x8f0 [ 18.877833] ? irqentry_exit_to_user_mode+0xc2/0x210 [ 18.879608] ? irqentry_exit+0x77/0xb0 [ 18.879808] ? clear_bhb_loop+0x15/0x70 [ 18.880023] ? clear_bhb_loop+0x15/0x70 [ 18.880223] ? clear_bhb_loop+0x15/0x70 [ 18.880426] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 18.880683] RIP: 0033:0x44a957 [ 18.880851] Code: ff ff e8 fc 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 8974 24 10 [ 18.881766] RSP: 002b:00007ffcdd00fad8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 18.882149] RAX: ffffffffffffffda RBX: 00007ffcdd010db8 RCX: 000000000044a957 [ 18.882507] RDX: 0000000000000000 RSI: 00007ffcdd00fb70 RDI: 0000000000000003 [ 18.885037] RBP: 00007ffcdd010bc0 R08: 000000000703c770 R09: 000000000703c7c0 [ 18.887203] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 18.888026] R13: 00007ffcdd010da8 R14: 00000000004ca7d0 R15: 0000000000000001 [ 18.888395] [ 18.888610] ---[ end trace ]--- The Linux kernel CVE team has assigned CVE-2025-21692 to this issue. Affected and fixed versions =========================== Issue introduced in 5.6 with commit dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 and fixed in 5.10.234 with commit 03c56665dab1f4ac844bc156652d50d639093fa5 Issue introduced in 5.6 with commit dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 and fixed in 5.15.178 with commit bcf0d815e728a3a304b50455b32a3170c16e1eaa Issue introduced in 5.6 with commit dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 and fixed in 6.1.128 with commit 1332c6ed446be787f901ed1064ec6a3c694f028a Issue introduced in 5.6 with commit dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 and fixed in 6.6.75 with commit f4168299e553f17aa2ba4016e77a9c38da40eb1d Issue introduced in 5.6 with commit dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 and fixed in 6.12.12 with commit 997f6ec4208b23c87daf9f044689685f091826f7 Issue introduced in 5.6 with commit dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 and fixed in 6.13.1 with commit f6b0f05fbfa4044f890e8a348288c0d9a20bd1d0 Issue introduced in 5.6 with commit dcc68b4d8084e1ac9af0d4022d6b1aff6a139a33 and fixed in 6.14-rc1 with commit d62b04fca4340a0d468d7853bd66e511935a18cb Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-21692 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/sched/sch_ets.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/03c56665dab1f4ac844bc156652d50d639093fa5 https://git.kernel.org/stable/c/bcf0d815e728a3a304b50455b32a3170c16e1eaa https://git.kernel.org/stable/c/1332c6ed446be787f901ed1064ec6a3c694f028a https://git.kernel.org/stable/c/f4168299e553f17aa2ba4016e77a9c38da40eb1d https://git.kernel.org/stable/c/997f6ec4208b23c87daf9f044689685f091826f7 https://git.kernel.org/stable/c/f6b0f05fbfa4044f890e8a348288c0d9a20bd1d0 https://git.kernel.org/stable/c/d62b04fca4340a0d468d7853bd66e511935a18cb