From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B62A31B2194 for ; Wed, 16 Apr 2025 14:15:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744812934; cv=none; b=ncyqtrja39HIxToFtiQ8XtdQIeWEI6at2+iUgaoPnUdh6PO94ldwNW7OxdWbiwl9kwYlmxoviO+MSWs9qGOWO9eeYwn1dWAJpMLAmV7HqwRXGTGUkIGNu1g1oCXec76zxj2dSUDTZyNzKC7W1K42o+UbAcTIJ6R4twmLuCShyyQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744812934; c=relaxed/simple; bh=7zvNm0oqEDYCbWSj5nzBibS+vzxrjp+4/bbKRSX535c=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gDCwy0lMIfeqDZZ5okK+mXuxQoelz+7k5dDKP3oK21RNI/wCn67mNyBH6dOoe4TEP03LHjgQOGTHpMx7RU+aWtACk61sEfHnEsSD8ozqDWYmvOrk6SNHp2aoFXx3a1x3ceDJZEGu/TofJKGjw1shoBKbRJOQOCosjjkOMQ5rZk8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0Y/PwIjA; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0Y/PwIjA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 27670C4CEED; Wed, 16 Apr 2025 14:15:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1744812934; bh=7zvNm0oqEDYCbWSj5nzBibS+vzxrjp+4/bbKRSX535c=; h=From:To:Cc:Subject:Date:Reply-to:From; b=0Y/PwIjA6O4SIQO1FFhmbKHxcCuOYS+LtBTxZyaR6qnG3IEN0ID+Hor9TyV12MLzA C+l6mrkFrtBE/SceimjC9TVICs9xPUCiQsJ3/a5ML9LYqXhcqFqs6mhcZEKHrGdOeI 24r1KmC1Ax+h/MYn+KEXxqPRu5Ue0J+QLMRLhaeM= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets Date: Wed, 16 Apr 2025 16:12:34 +0200 Message-ID: <2025041607-CVE-2025-22063-dec0@gregkh> X-Mailer: git-send-email 2.49.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3903; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=7zvNm0oqEDYCbWSj5nzBibS+vzxrjp+4/bbKRSX535c=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn/d22veKvLq8NrW9Fgd9l+ie3rOetLViu2N7mZndTbH PVrp6VvRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAExkYQPDgo67BduXXfbt0a6t ORIQuNdxX49FGMP84BCufQwuDXdmfW5+zdUz9dS6F/e8AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket, but the connect function is called with an IPv6 address, the function calipso_sock_setattr() is triggered. Inside this function, the following code is executed: sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL; Since sk is an IPv4 socket, pinet6 is NULL, leading to a null pointer dereference. This patch fixes the issue by checking if inet6_sk(sk) returns a NULL pointer before accessing pinet6. The Linux kernel CVE team has assigned CVE-2025-22063 to this issue. Affected and fixed versions =========================== Issue introduced in 4.8 with commit ceba1832b1b2da0149c51de62a847c00bca1677a and fixed in 5.4.292 with commit 1ad9166cab6a0f5c0b10344a97bdf749ae11dcbf Issue introduced in 4.8 with commit ceba1832b1b2da0149c51de62a847c00bca1677a and fixed in 5.10.236 with commit 1e38f7a6cdd68377f8a4189b2fbaec14a6dd5152 Issue introduced in 4.8 with commit ceba1832b1b2da0149c51de62a847c00bca1677a and fixed in 5.15.180 with commit a7e89541d05b98c79a51c0f95df020f8e82b62ed Issue introduced in 4.8 with commit ceba1832b1b2da0149c51de62a847c00bca1677a and fixed in 6.1.134 with commit 797e5371cf55463b4530bab3fef5f27f7c6657a8 Issue introduced in 4.8 with commit ceba1832b1b2da0149c51de62a847c00bca1677a and fixed in 6.6.87 with commit 1927d0bcd5b81e80971bf6b8eba267508bd1c78b Issue introduced in 4.8 with commit ceba1832b1b2da0149c51de62a847c00bca1677a and fixed in 6.12.23 with commit 3ba9cf69de50e8abed32b448616c313baa4c5712 Issue introduced in 4.8 with commit ceba1832b1b2da0149c51de62a847c00bca1677a and fixed in 6.13.11 with commit 9fe3839588db7519030377b7dee3f165e654f6c5 Issue introduced in 4.8 with commit ceba1832b1b2da0149c51de62a847c00bca1677a and fixed in 6.14.2 with commit 172a8a996a337206970467e871dd995ac07640b1 Issue introduced in 4.8 with commit ceba1832b1b2da0149c51de62a847c00bca1677a and fixed in 6.15-rc1 with commit 078aabd567de3d63d37d7673f714e309d369e6e2 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-22063 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/ipv6/calipso.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/1ad9166cab6a0f5c0b10344a97bdf749ae11dcbf https://git.kernel.org/stable/c/1e38f7a6cdd68377f8a4189b2fbaec14a6dd5152 https://git.kernel.org/stable/c/a7e89541d05b98c79a51c0f95df020f8e82b62ed https://git.kernel.org/stable/c/797e5371cf55463b4530bab3fef5f27f7c6657a8 https://git.kernel.org/stable/c/1927d0bcd5b81e80971bf6b8eba267508bd1c78b https://git.kernel.org/stable/c/3ba9cf69de50e8abed32b448616c313baa4c5712 https://git.kernel.org/stable/c/9fe3839588db7519030377b7dee3f165e654f6c5 https://git.kernel.org/stable/c/172a8a996a337206970467e871dd995ac07640b1 https://git.kernel.org/stable/c/078aabd567de3d63d37d7673f714e309d369e6e2