CVE-2025-21653

一、漏洞信息
 漏洞编号：[CVE-2025-21653](https://nvd.nist.gov/vuln/detail/CVE-2025-21653)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：4.7 Medium
  Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net_sched: cls_flow: validate TCA_FLOW_RSHIFT attributesyzbot found that TCA_FLOW_RSHIFT attribute was not validated.Right shitfing a 32bit integer is undefined for large shift values.UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23shift exponent 9445 is too large for 32-bit type  u32  (aka  unsigned int )CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024Workqueue: ipv6_addrconf addrconf_dad_workCall Trace: <TASK>  __dump_stack lib/dump_stack.c:94 [inline]  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120  ubsan_epilogue lib/ubsan.c:231 [inline]  __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468  flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329  tc_classify include/net/tc_wrapper.h:197 [inline]  __tcf_classify net/sched/cls_api.c:1771 [inline]  tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867  sfb_classify net/sched/sch_sfb.c:260 [inline]  sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318  dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793  __dev_xmit_skb net/core/dev.c:3889 [inline]  __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400  dev_queue_xmit include/linux/netdevice.h:3168 [inline]  neigh_hh_output include/net/neighbour.h:523 [inline]  neigh_output include/net/neighbour.h:537 [inline]  ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236  iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82  udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173  geneve_xmit_skb drivers/net/geneve.c:916 [inline]  geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039  __netdev_start_xmit include/linux/netdevice.h:5002 [inline]  netdev_start_xmit include/linux/netdevice.h:5011 [inline]  xmit_one net/core/dev.c:3590 [inline]  dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606  __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434
 漏洞公开时间：2025-01-19 19:15:10
 漏洞创建时间：2025-01-19 20:24:18
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-21653
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2011749ca96460386844dfc7e0fde53ebee96f3c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/43658e4a5f2770ad94e93362885ff51c10cf3179 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/6fde663f7321418996645ee602a473457640542f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9858f4afeb2e59506e714176bd3e135539a3eeec |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a039e54397c6a75b713b9ce7894a62e06956aa92 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a313d6e6d5f3a631cae5a241c392c28868aa5c5e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e54beb9aed2a90dddf4c5d68fcfc9a01f3e40a61 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21653 | https://bugzilla.suse.com/show_bug.cgi?id=1236161 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21653.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1236161 |
| suse_bugzilla | https://git.kernel.org/stable/c/2011749ca96460386844dfc7e0fde53ebee96f3c | https://bugzilla.suse.com/show_bug.cgi?id=1236161 |
| suse_bugzilla | https://git.kernel.org/stable/c/e54beb9aed2a90dddf4c5d68fcfc9a01f3e40a61 | https://bugzilla.suse.com/show_bug.cgi?id=1236161 |
| suse_bugzilla | https://git.kernel.org/stable/c/6fde663f7321418996645ee602a473457640542f | https://bugzilla.suse.com/show_bug.cgi?id=1236161 |
| suse_bugzilla | https://git.kernel.org/stable/c/a039e54397c6a75b713b9ce7894a62e06956aa92 | https://bugzilla.suse.com/show_bug.cgi?id=1236161 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-21653 | https://bugzilla.suse.com/show_bug.cgi?id=1236161 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2338817 | https://bugzilla.suse.com/show_bug.cgi?id=1236161 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025011947-CVE-2025-21653-b6c0@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2338817 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-21653 |
| mageia |  | http://advisories.mageia.org/MGASA-2025-0030.html |
| osv | https://git.kernel.org/stable/c/2011749ca96460386844dfc7e0fde53ebee96f3c | https://osv.dev/vulnerability/CVE-2025-21653 |
| osv | https://git.kernel.org/stable/c/43658e4a5f2770ad94e93362885ff51c10cf3179 | https://osv.dev/vulnerability/CVE-2025-21653 |
| osv | https://git.kernel.org/stable/c/6fde663f7321418996645ee602a473457640542f | https://osv.dev/vulnerability/CVE-2025-21653 |
| osv | https://git.kernel.org/stable/c/9858f4afeb2e59506e714176bd3e135539a3eeec | https://osv.dev/vulnerability/CVE-2025-21653 |
| osv | https://git.kernel.org/stable/c/a039e54397c6a75b713b9ce7894a62e06956aa92 | https://osv.dev/vulnerability/CVE-2025-21653 |
| osv | https://git.kernel.org/stable/c/a313d6e6d5f3a631cae5a241c392c28868aa5c5e | https://osv.dev/vulnerability/CVE-2025-21653 |
| osv | https://git.kernel.org/stable/c/e54beb9aed2a90dddf4c5d68fcfc9a01f3e40a61 | https://osv.dev/vulnerability/CVE-2025-21653 |
| osv | https://security-tracker.debian.org/tracker/CVE-2025-21653 | https://osv.dev/vulnerability/CVE-2025-21653 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 6.1.125 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2011749ca96460386844dfc7e0fde53ebee96f3cIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e5dfb815181fcb186d6080ac3a091eadff2d98fe | linuxkernelcves |
| linux_kernel | 6.6.72 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e54beb9aed2a90dddf4c5d68fcfc9a01f3e40a61Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e5dfb815181fcb186d6080ac3a091eadff2d98fe | linuxkernelcves |
| linux_kernel | 6.12.10 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6fde663f7321418996645ee602a473457640542fIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e5dfb815181fcb186d6080ac3a091eadff2d98fe | linuxkernelcves |
| linux_kernel | 6.13-rc7 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a039e54397c6a75b713b9ce7894a62e06956aa92Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e5dfb815181fcb186d6080ac3a091eadff2d98fe | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net_sched: cls_flow: validate TCA_FLOW_RSHIFT attributesyzbot found that TCA_FLOW_RSHIFT attribute was not validated.Right shitfing a 32bit integer is undefined for large shift values.UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23shift exponent 9445 is too large for 32-bit type &#39;u32&#39; (aka &#39;unsigned int&#39;)CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024Workqueue: ipv6_addrconf addrconf_dad_workCall Trace: &lt;TASK&gt;  __dump_stack lib/dump_stack.c:94 [inline]  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120  ubsan_epilogue lib/ubsan.c:231 [inline]  __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468  flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329  tc_classify include/net/tc_wrapper.h:197 [inline]  __tcf_classify net/sched/cls_api.c:1771 [inline]  tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867  sfb_classify net/sched/sch_sfb.c:260 [inline]  sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318  dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793  __dev_xmit_skb net/core/dev.c:3889 [inline]  __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400  dev_queue_xmit include/linux/netdevice.h:3168 [inline]  neigh_hh_output include/net/neighbour.h:523 [inline]  neigh_output include/net/neighbour.h:537 [inline]  ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236  iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82  udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173  geneve_xmit_skb drivers/net/geneve.c:916 [inline]  geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039  __netdev_start_xmit include/linux/netdevice.h:5002 [inline]  netdev_start_xmit include/linux/netdevice.h:5011 [inline]  xmit_one net/core/dev.c:3590 [inline]  dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606  __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434The Linux kernel CVE team has assigned CVE-2025-21653 to this issue.
 openEuler评分：
  5.3
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.6.0):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.openEuler-24.03-LTS(6.6.0):正常修复
3.openEuler-24.03-LTS-SP1(6.6.0):正常修复
4.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
5.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
6.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1160

src-openEuler/kernel
关闭

内容风险标识

评论 (9)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-21653

评论 (9)

搜索帮助

src-openEuler/kernel
关闭