CVE-2025-21779

一、漏洞信息
 漏洞编号：[CVE-2025-21779](https://nvd.nist.gov/vuln/detail/CVE-2025-21779)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.x分值：
  BaseScore：5.5 Medium
  Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:KVM: x86: Reject Hyper-V s SEND_IPI hypercalls if local APIC isn t in-kernelAdvertise support for Hyper-V s SEND_IPI and SEND_IPI_EX hypercalls if andonly if the local API is emulated/virtualized by KVM, and explicitly rejectsaid hypercalls if the local APIC is emulated in userspace, i.e. don t relyon userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID.Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference ifHyper-V enlightenments are exposed to the guest without an in-kernel localAPIC:  dump_stack+0xbe/0xfd  __kasan_report.cold+0x34/0x84  kasan_report+0x3a/0x50  __apic_accept_irq+0x3a/0x5c0  kvm_hv_send_ipi.isra.0+0x34e/0x820  kvm_hv_hypercall+0x8d9/0x9d0  kvm_emulate_hypercall+0x506/0x7e0  __vmx_handle_exit+0x283/0xb60  vmx_handle_exit+0x1d/0xd0  vcpu_enter_guest+0x16b0/0x24c0  vcpu_run+0xc0/0x550  kvm_arch_vcpu_ioctl_run+0x170/0x6d0  kvm_vcpu_ioctl+0x413/0xb20  __se_sys_ioctl+0x111/0x160  do_syscal1_64+0x30/0x40  entry_SYSCALL_64_after_hwframe+0x67/0xd1Note, checking the sending vCPU is sufficient, as the per-VM irqchip_modecan t be modified after vCPUs are created, i.e. if one vCPU has anin-kernel local APIC, then all vCPUs have an in-kernel local APIC.
 漏洞公开时间：2025-02-27 11:15:18
 漏洞创建时间：2025-02-27 13:05:10
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-21779
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/45fa526b0f5a34492ed0536c3cdf88b78380e4de |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5393cf22312418262679eaadb130d608c75fe690 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/61224533f2b61e252b03e214195d27d64b22989a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/874ff13c73c45ecb38cb82191e8c1d523f0dc81b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a8de7f100bb5989d9c3627d3a223ee1c863f3b69 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/aca8be4403fb90db7adaf63830e27ebe787a76e8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ca29f58ca374c40a0e69c5306fc5c940a0069074 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21779 | https://bugzilla.suse.com/show_bug.cgi?id=1238768 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21779.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1238768 |
| suse_bugzilla | https://git.kernel.org/stable/c/5393cf22312418262679eaadb130d608c75fe690 | https://bugzilla.suse.com/show_bug.cgi?id=1238768 |
| suse_bugzilla | https://git.kernel.org/stable/c/874ff13c73c45ecb38cb82191e8c1d523f0dc81b | https://bugzilla.suse.com/show_bug.cgi?id=1238768 |
| suse_bugzilla | https://git.kernel.org/stable/c/aca8be4403fb90db7adaf63830e27ebe787a76e8 | https://bugzilla.suse.com/show_bug.cgi?id=1238768 |
| suse_bugzilla | https://git.kernel.org/stable/c/ca29f58ca374c40a0e69c5306fc5c940a0069074 | https://bugzilla.suse.com/show_bug.cgi?id=1238768 |
| suse_bugzilla | https://git.kernel.org/stable/c/a8de7f100bb5989d9c3627d3a223ee1c863f3b69 | https://bugzilla.suse.com/show_bug.cgi?id=1238768 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-21779 | https://bugzilla.suse.com/show_bug.cgi?id=1238768 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2348613 | https://bugzilla.suse.com/show_bug.cgi?id=1238768 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025022607-CVE-2025-21779-f239@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2348613 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/5393cf22312418262679eaadb130d608c75fe690 |  | nvd |
|  |  | https://git.kernel.org/stable/c/874ff13c73c45ecb38cb82191e8c1d523f0dc81b |  | nvd |
|  |  | https://git.kernel.org/stable/c/a8de7f100bb5989d9c3627d3a223ee1c863f3b69 |  | nvd |
|  |  | https://git.kernel.org/stable/c/aca8be4403fb90db7adaf63830e27ebe787a76e8 |  | nvd |
|  |  | https://git.kernel.org/stable/c/ca29f58ca374c40a0e69c5306fc5c940a0069074 |  | nvd |
| linux_kernel | 6.1.129 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5393cf22312418262679eaadb130d608c75fe690Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=214ff83d4473a7757fa18a64dc7efe3b0e158486 | linuxkernelcves |
| linux_kernel | 6.6.79 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=874ff13c73c45ecb38cb82191e8c1d523f0dc81bIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=214ff83d4473a7757fa18a64dc7efe3b0e158486 | linuxkernelcves |
| linux_kernel | 6.12.16 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aca8be4403fb90db7adaf63830e27ebe787a76e8Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=214ff83d4473a7757fa18a64dc7efe3b0e158486 | linuxkernelcves |
| linux_kernel | 6.13.4 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ca29f58ca374c40a0e69c5306fc5c940a0069074Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=214ff83d4473a7757fa18a64dc7efe3b0e158486 | linuxkernelcves |
| linux_kernel | 6.14-rc3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a8de7f100bb5989d9c3627d3a223ee1c863f3b69Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=214ff83d4473a7757fa18a64dc7efe3b0e158486 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:KVM: x86: Reject Hyper-V&#39;s SEND_IPI hypercalls if local APIC isn&#39;t in-kernelAdvertise support for Hyper-V&#39;s SEND_IPI and SEND_IPI_EX hypercalls if andonly if the local API is emulated/virtualized by KVM, and explicitly rejectsaid hypercalls if the local APIC is emulated in userspace, i.e. don&#39;t relyon userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID.Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference ifHyper-V enlightenments are exposed to the guest without an in-kernel localAPIC:  dump_stack+0xbe/0xfd  __kasan_report.cold+0x34/0x84  kasan_report+0x3a/0x50  __apic_accept_irq+0x3a/0x5c0  kvm_hv_send_ipi.isra.0+0x34e/0x820  kvm_hv_hypercall+0x8d9/0x9d0  kvm_emulate_hypercall+0x506/0x7e0  __vmx_handle_exit+0x283/0xb60  vmx_handle_exit+0x1d/0xd0  vcpu_enter_guest+0x16b0/0x24c0  vcpu_run+0xc0/0x550  kvm_arch_vcpu_ioctl_run+0x170/0x6d0  kvm_vcpu_ioctl+0x413/0xb20  __se_sys_ioctl+0x111/0x160  do_syscal1_64+0x30/0x40  entry_SYSCALL_64_after_hwframe+0x67/0xd1Note, checking the sending vCPU is sufficient, as the per-VM irqchip_modecan&#39;t be modified after vCPUs are created, i.e. if one vCPU has anin-kernel local APIC, then all vCPUs have an in-kernel local APIC.The Linux kernel CVE team has assigned CVE-2025-21779 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-24.03-LTS:受影响
4.openEuler-24.03-LTS-SP1:受影响
5.master(6.12.33):不受影响
6.openEuler-20.03-LTS-SP4:不受影响
7.openEuler-24.03-LTS-Next:不受影响
8.openEuler-24.03-LTS-SP2:不受影响
9.openEuler-24.03-LTS-SP3:不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否
9.openEuler-24.03-LTS-SP3:否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.openEuler-22.03-LTS-SP4(5.10.0):正常修复
3.openEuler-24.03-LTS:正常修复
4.openEuler-24.03-LTS-SP1:正常修复
5.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-20.03-LTS-SP4:不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发
9.openEuler-24.03-LTS-SP3:不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel
Closed

Content Risk Flag

Comments (14)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-21779

Comments (14)

Search

src-openEuler/kernel
Closed