CVE-2025-21693

一、漏洞信息
 漏洞编号：[CVE-2025-21693](https://nvd.nist.gov/vuln/detail/CVE-2025-21693)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.x分值：
  BaseScore：7.8 High
  Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:mm: zswap: properly synchronize freeing resources during CPU hotunplugIn zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of thecurrent CPU at the beginning of the operation is retrieved and usedthroughout.  However, since neither preemption nor migration are disabled,it is possible that the operation continues on a different CPU.If the original CPU is hotunplugged while the acomp_ctx is still in use,we run into a UAF bug as some of the resources attached to the acomp_ctxare freed during hotunplug in zswap_cpu_comp_dead() (i.e. acomp_ctx.buffer, acomp_ctx.req, or acomp_ctx.acomp).The problem was introduced in commit 1ec3b5fe6eec ( mm/zswap: move to usecrypto_acomp API for hardware acceleration ) when the switch to thecrypto_acomp API was made.  Prior to that, the per-CPU crypto_comp wasretrieved using get_cpu_ptr() which disables preemption and makes sure theCPU cannot go away from under us.  Preemption cannot be disabled with thecrypto_acomp API as a sleepable context is needed.Use the acomp_ctx.mutex to synchronize CPU hotplug callbacks allocatingand freeing resources with compression/decompression paths.  Make surethat acomp_ctx.req is NULL when the resources are freed.  In thecompression/decompression paths, check if acomp_ctx.req is NULL afteracquiring the mutex (meaning the CPU was offlined) and retry on the newCPU.The initialization of acomp_ctx.mutex is moved from the CPU hotplugcallback to the pool initialization where it belongs (where the mutex isallocated).  In addition to adding clarity, this makes sure that CPUhotplug cannot reinitialize a mutex that is already locked bycompression/decompression.Previously a fix was attempted by holding cpus_read_lock() [1].  Thiswould have caused a potential deadlock as it is possible for code alreadyholding the lock to fall into reclaim and enter zswap (causing adeadlock).  A fix was also attempted using SRCU for synchronization, butJohannes pointed out that synchronize_srcu() cannot be used in CPU hotplugnotifiers [2].Alternative fixes that were considered/attempted and could have worked:- Refcounting the per-CPU acomp_ctx. This involves complexity in  handling the race between the refcount dropping to zero in  zswap_[de]compress() and the refcount being re-initialized when the  CPU is onlined.- Disabling migration before getting the per-CPU acomp_ctx [3], but  that s discouraged and is a much bigger hammer than needed, and could  result in subtle performance issues.[1]https://lkml.kernel.org/
 漏洞公开时间：2025-02-11 00:15:38
 漏洞创建时间：2025-02-11 00:57:08
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-21693
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/12dcb0ef540629a281533f9dedc1b6b8e14cfb65 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8d29ff5d50304daa41dc3cfdda4a9d1e46cf5be1 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21693 | https://bugzilla.suse.com/show_bug.cgi?id=1237029 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-21693 | https://bugzilla.suse.com/show_bug.cgi?id=1237029 |
| suse_bugzilla | https://git.kernel.org/stable/c/12dcb0ef540629a281533f9dedc1b6b8e14cfb65 | https://bugzilla.suse.com/show_bug.cgi?id=1237029 |
| suse_bugzilla | https://git.kernel.org/stable/c/8d29ff5d50304daa41dc3cfdda4a9d1e46cf5be1 | https://bugzilla.suse.com/show_bug.cgi?id=1237029 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21693.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1237029 |
| suse_bugzilla | https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/21xxx/CVE-2025-21693.json | https://bugzilla.suse.com/show_bug.cgi?id=1237029 |
| redhat_bugzilla | https://lkml.kernel.org/20241219212437.2714151-1-yosryahmed@google.com/ | https://bugzilla.redhat.com/show_bug.cgi?id=2344684 |
| redhat_bugzilla | https://lkml.kernel.org/20250107074724.1756696-2-yosryahmed@google.com/ | https://bugzilla.redhat.com/show_bug.cgi?id=2344684 |
| redhat_bugzilla | https://lkml.kernel.org/20250107222236.2715883-2-yosryahmed@google.com/ | https://bugzilla.redhat.com/show_bug.cgi?id=2344684 |
| redhat_bugzilla | https://lkml.kernel.org/r/CAJD7tkaxS1wjn+swugt8QCvQ-rVF5RZnjxwPGX17k8x9zSManA@mail.gmail.com | https://bugzilla.redhat.com/show_bug.cgi?id=2344684 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025021056-CVE-2025-21693-b6d1@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2344684 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2025-21693 | https://explore.alas.aws.amazon.com/CVE-2025-21693.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21693 | https://explore.alas.aws.amazon.com/CVE-2025-21693.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/12dcb0ef540629a281533f9dedc1b6b8e14cfb65 |  | nvd |
|  |  | https://git.kernel.org/stable/c/8d29ff5d50304daa41dc3cfdda4a9d1e46cf5be1 |  | nvd |
| linux_kernel | 6.12.12 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8d29ff5d50304daa41dc3cfdda4a9d1e46cf5be1Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1ec3b5fe6eec782f4e5e0a80e4ce1909ffd5d161 | linuxkernelcves |
| linux_kernel | 6.13 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=12dcb0ef540629a281533f9dedc1b6b8e14cfb65Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1ec3b5fe6eec782f4e5e0a80e4ce1909ffd5d161 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:mm: zswap: properly synchronize freeing resources during CPU hotunplugIn zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of thecurrent CPU at the beginning of the operation is retrieved and usedthroughout.  However, since neither preemption nor migration are disabled,it is possible that the operation continues on a different CPU.If the original CPU is hotunplugged while the acomp_ctx is still in use,we run into a UAF bug as some of the resources attached to the acomp_ctxare freed during hotunplug in zswap_cpu_comp_dead() (i.e. acomp_ctx.buffer, acomp_ctx.req, or acomp_ctx.acomp).The problem was introduced in commit 1ec3b5fe6eec (&#34;mm/zswap: move to usecrypto_acomp API for hardware acceleration&#34;) when the switch to thecrypto_acomp API was made.  Prior to that, the per-CPU crypto_comp wasretrieved using get_cpu_ptr() which disables preemption and makes sure theCPU cannot go away from under us.  Preemption cannot be disabled with thecrypto_acomp API as a sleepable context is needed.Use the acomp_ctx.mutex to synchronize CPU hotplug callbacks allocatingand freeing resources with compression/decompression paths.  Make surethat acomp_ctx.req is NULL when the resources are freed.  In thecompression/decompression paths, check if acomp_ctx.req is NULL afteracquiring the mutex (meaning the CPU was offlined) and retry on the newCPU.The initialization of acomp_ctx.mutex is moved from the CPU hotplugcallback to the pool initialization where it belongs (where the mutex isallocated).  In addition to adding clarity, this makes sure that CPUhotplug cannot reinitialize a mutex that is already locked bycompression/decompression.Previously a fix was attempted by holding cpus_read_lock() [1].  Thiswould have caused a potential deadlock as it is possible for code alreadyholding the lock to fall into reclaim and enter zswap (causing adeadlock).  A fix was also attempted using SRCU for synchronization, butJohannes pointed out that synchronize_srcu() cannot be used in CPU hotplugnotifiers [2].Alternative fixes that were considered/attempted and could have worked:- Refcounting the per-CPU acomp_ctx. This involves complexity in  handling the race between the refcount dropping to zero in  zswap_[de]compress() and the refcount being re-initialized when the  CPU is onlined.- Disabling migration before getting the per-CPU acomp_ctx [3], but  that&#39;s discouraged and is a much bigger hammer than needed, and could  result in subtle performance issues.[1]<ahref= https://lkml.kernel.org/20241219212437.2714151-1-yosryahmed@google.com/ >https://lkml.kernel.org/20241219212437.2714151-1-yosryahmed@google.com/</a>[2]<ahref= https://lkml.kernel.org/20250107074724.1756696-2-yosryahmed@google.com/ >https://lkml.kernel.org/20250107074724.1756696-2-yosryahmed@google.com/</a>[3]<ahref= https://lkml.kernel.org/20250107222236.2715883-2-yosryahmed@google.com/ >https://lkml.kernel.org/20250107222236.2715883-2-yosryahmed@google.com/</a>[yosryahmed@google.com: remove comment]  Link: <ahref= https://lkml.kernel.org/r/CAJD7tkaxS1wjn+swugt8QCvQ-rVF5RZnjxwPGX17k8x9zSManA@mail.gmail.com >https://lkml.kernel.org/r/CAJD7tkaxS1wjn+swugt8QCvQ-rVF5RZnjxwPGX17k8x9zSManA@mail.gmail.com</a>The Linux kernel CVE team has assigned CVE-2025-21693 to this issue.
 openEuler评分：
  7.8
 Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-24.03-LTS-SP1(6.6.0):受影响
5.openEuler-24.03-LTS-SP2(6.6.0):受影响
6.openEuler-24.03-LTS-SP3(6.6.0):不受影响
7.master(6.12.33):不受影响
8.openEuler-20.03-LTS-SP4(4.19.90):不受影响
9.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否
9.openEuler-24.03-LTS-SP3(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.openEuler-22.03-LTS-SP4(5.10.0):正常修复
3.openEuler-24.03-LTS(6.6.0):正常修复
4.openEuler-24.03-LTS-SP1(6.6.0):正常修复
5.openEuler-24.03-LTS-SP2(6.6.0):正常修复
6.openEuler-24.03-LTS-SP3(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
9.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2776

src-openEuler / kernel
Closed

Content Risk Flag

Comments (37)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-21693

Comments (37)

Search

src-openEuler / kernel
Closed