CVE-2025-21866

一、漏洞信息
 漏洞编号：[CVE-2025-21866](https://nvd.nist.gov/vuln/detail/CVE-2025-21866)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.x分值：
  BaseScore：5.5 Medium
  Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOCErhard reported the following KASAN hit while booting his PowerMac G4with a KASAN-enabled kernel 6.13-rc6:  BUG: KASAN: vmalloc-out-of-bounds in copy_to_kernel_nofault+0xd8/0x1c8  Write of size 8 at addr f1000000 by task chronyd/1293  CPU: 0 UID: 123 PID: 1293 Comm: chronyd Tainted: G        W          6.13.0-rc6-PMacG4 #2  Tainted: [W]=WARN  Hardware name: PowerMac3,6 7455 0x80010303 PowerMac  Call Trace:  [c2437590] [c1631a84] dump_stack_lvl+0x70/0x8c (unreliable)  [c24375b0] [c0504998] print_report+0xdc/0x504  [c2437610] [c050475c] kasan_report+0xf8/0x108  [c2437690] [c0505a3c] kasan_check_range+0x24/0x18c  [c24376a0] [c03fb5e4] copy_to_kernel_nofault+0xd8/0x1c8  [c24376c0] [c004c014] patch_instructions+0x15c/0x16c  [c2437710] [c00731a8] bpf_arch_text_copy+0x60/0x7c  [c2437730] [c0281168] bpf_jit_binary_pack_finalize+0x50/0xac  [c2437750] [c0073cf4] bpf_int_jit_compile+0xb30/0xdec  [c2437880] [c0280394] bpf_prog_select_runtime+0x15c/0x478  [c24378d0] [c1263428] bpf_prepare_filter+0xbf8/0xc14  [c2437990] [c12677ec] bpf_prog_create_from_user+0x258/0x2b4  [c24379d0] [c027111c] do_seccomp+0x3dc/0x1890  [c2437ac0] [c001d8e0] system_call_exception+0x2dc/0x420  [c2437f30] [c00281ac] ret_from_syscall+0x0/0x2c  --- interrupt: c00 at 0x5a1274  NIP:  005a1274 LR: 006a3b3c CTR: 005296c8  REGS: c2437f40 TRAP: 0c00   Tainted: G        W           (6.13.0-rc6-PMacG4)  MSR:  0200f932 <VEC,EE,PR,FP,ME,IR,DR,RI>  CR: 24004422  XER: 00000000  GPR00: 00000166 af8f3fa0 a7ee3540 00000001 00000000 013b6500 005a5858 0200f932  GPR08: 00000000 00001fe9 013d5fc8 005296c8 2822244c 00b2fcd8 00000000 af8f4b57  GPR16: 00000000 00000001 00000000 00000000 00000000 00000001 00000000 00000002  GPR24: 00afdbb0 00000000 00000000 00000000 006e0004 013ce060 006e7c1c 00000001  NIP [005a1274] 0x5a1274  LR [006a3b3c] 0x6a3b3c  --- interrupt: c00  The buggy address belongs to the virtual mapping at   [f1000000, f1002000) created by:   text_area_cpu_up+0x20/0x190  The buggy address belongs to the physical page:  page: refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x76e30  flags: 0x80000000(zone=2)  raw: 80000000 00000000 00000122 00000000 00000000 00000000 ffffffff 00000001  raw: 00000000  page dumped because: kasan: bad access detected  Memory state around the buggy address:   f0ffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   f0ffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >f1000000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8             ^   f1000080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8   f1000100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8  ==================================================================f8 corresponds to KASAN_VMALLOC_INVALID which means the area is notinitialised hence not supposed to be used yet.Powerpc text patching infrastructure allocates a virtual memory areausing get_vm_area() and flags it as VM_ALLOC. But that flag is meantto be used for vmalloc() and vmalloc() allocated memory is notsupposed to be used before a call to __vmalloc_node_range() which isnever called for that area.That went undetected until commit e4137f08816b ( mm, kasan, kmsan:instrument copy_from/to_kernel_nofault )The area allocated by text_area_cpu_up() is not vmalloc memory, it ismapped directly on demand when needed by map_kernel_page(). There isno VM flag corresponding to such usage, so just pass no flag. That waythe area will be unpoisonned and usable immediately.
 漏洞公开时间：2025-03-12 18:15:19
 漏洞创建时间：2025-03-12 18:34:42
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-21866
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2d542f13d26344e3452eee77613026ce9b653065 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2e6c80423f201405fd65254e52decd21663896f3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/6847b3e40bb963e57b61d1cc6fe84cb37b9d3d4c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8d06e9208184b2851fa79a3a39d6860320c8bdf8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/97de5852058a299ba447cd9782fe96488d30108b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c905a3053518212a1017e50bd2be3bee59305bb0 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d262a192d38e527faa5984629aabda2e0d1c4f54 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f8d4c5b653c1bc0df56e15658bbf64fc359adc4e |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21866 | https://bugzilla.suse.com/show_bug.cgi?id=1239473 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21866.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1239473 |
| suse_bugzilla | https://git.kernel.org/stable/c/c905a3053518212a1017e50bd2be3bee59305bb0 | https://bugzilla.suse.com/show_bug.cgi?id=1239473 |
| suse_bugzilla | https://git.kernel.org/stable/c/2d542f13d26344e3452eee77613026ce9b653065 | https://bugzilla.suse.com/show_bug.cgi?id=1239473 |
| suse_bugzilla | https://git.kernel.org/stable/c/8d06e9208184b2851fa79a3a39d6860320c8bdf8 | https://bugzilla.suse.com/show_bug.cgi?id=1239473 |
| suse_bugzilla | https://git.kernel.org/stable/c/2e6c80423f201405fd65254e52decd21663896f3 | https://bugzilla.suse.com/show_bug.cgi?id=1239473 |
| suse_bugzilla | https://git.kernel.org/stable/c/d262a192d38e527faa5984629aabda2e0d1c4f54 | https://bugzilla.suse.com/show_bug.cgi?id=1239473 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-21866 | https://bugzilla.suse.com/show_bug.cgi?id=1239473 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025031218-CVE-2025-21866-11c0@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2351623 |
| osv | https://git.kernel.org/stable/c/2d542f13d26344e3452eee77613026ce9b653065 | https://osv.dev/vulnerability/CVE-2025-21866 |
| osv | https://git.kernel.org/stable/c/2e6c80423f201405fd65254e52decd21663896f3 | https://osv.dev/vulnerability/CVE-2025-21866 |
| osv | https://git.kernel.org/stable/c/6847b3e40bb963e57b61d1cc6fe84cb37b9d3d4c | https://osv.dev/vulnerability/CVE-2025-21866 |
| osv | https://git.kernel.org/stable/c/8d06e9208184b2851fa79a3a39d6860320c8bdf8 | https://osv.dev/vulnerability/CVE-2025-21866 |
| osv | https://git.kernel.org/stable/c/97de5852058a299ba447cd9782fe96488d30108b | https://osv.dev/vulnerability/CVE-2025-21866 |
| osv | https://git.kernel.org/stable/c/c905a3053518212a1017e50bd2be3bee59305bb0 | https://osv.dev/vulnerability/CVE-2025-21866 |
| osv | https://git.kernel.org/stable/c/d262a192d38e527faa5984629aabda2e0d1c4f54 | https://osv.dev/vulnerability/CVE-2025-21866 |
| osv | https://git.kernel.org/stable/c/f8d4c5b653c1bc0df56e15658bbf64fc359adc4e | https://osv.dev/vulnerability/CVE-2025-21866 |
| osv | https://security-tracker.debian.org/tracker/CVE-2025-21866 | https://osv.dev/vulnerability/CVE-2025-21866 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/2d542f13d26344e3452eee77613026ce9b653065 |  | nvd |
|  |  | https://git.kernel.org/stable/c/2e6c80423f201405fd65254e52decd21663896f3 |  | nvd |
|  |  | https://git.kernel.org/stable/c/6847b3e40bb963e57b61d1cc6fe84cb37b9d3d4c |  | nvd |
|  |  | https://git.kernel.org/stable/c/8d06e9208184b2851fa79a3a39d6860320c8bdf8 |  | nvd |
|  |  | https://git.kernel.org/stable/c/97de5852058a299ba447cd9782fe96488d30108b |  | nvd |
|  |  | https://git.kernel.org/stable/c/c905a3053518212a1017e50bd2be3bee59305bb0 |  | nvd |
|  |  | https://git.kernel.org/stable/c/d262a192d38e527faa5984629aabda2e0d1c4f54 |  | nvd |
|  |  | https://git.kernel.org/stable/c/f8d4c5b653c1bc0df56e15658bbf64fc359adc4e |  | nvd |
| linux_kernel | 6.1.130 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c905a3053518212a1017e50bd2be3bee59305bb0Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=37bc3e5fd764fb258ff4fcbb90b6d1b67fb466c1 | linuxkernelcves |
| linux_kernel | 6.6.80 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2d542f13d26344e3452eee77613026ce9b653065Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=37bc3e5fd764fb258ff4fcbb90b6d1b67fb466c1 | linuxkernelcves |
| linux_kernel | 6.12.17 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8d06e9208184b2851fa79a3a39d6860320c8bdf8Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=37bc3e5fd764fb258ff4fcbb90b6d1b67fb466c1 | linuxkernelcves |
| linux_kernel | 6.13.5 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2e6c80423f201405fd65254e52decd21663896f3Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=37bc3e5fd764fb258ff4fcbb90b6d1b67fb466c1 | linuxkernelcves |
| linux_kernel | 6.14-rc4 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d262a192d38e527faa5984629aabda2e0d1c4f54Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=37bc3e5fd764fb258ff4fcbb90b6d1b67fb466c1 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOCErhard reported the following KASAN hit while booting his PowerMac G4with a KASAN-enabled kernel 6.13-rc6:  BUG: KASAN: vmalloc-out-of-bounds in copy_to_kernel_nofault+0xd8/0x1c8  Write of size 8 at addr f1000000 by task chronyd/1293  CPU: 0 UID: 123 PID: 1293 Comm: chronyd Tainted: G        W          6.13.0-rc6-PMacG4 #2  Tainted: [W]=WARN  Hardware name: PowerMac3,6 7455 0x80010303 PowerMac  Call Trace:  [c2437590] [c1631a84] dump_stack_lvl+0x70/0x8c (unreliable)  [c24375b0] [c0504998] print_report+0xdc/0x504  [c2437610] [c050475c] kasan_report+0xf8/0x108  [c2437690] [c0505a3c] kasan_check_range+0x24/0x18c  [c24376a0] [c03fb5e4] copy_to_kernel_nofault+0xd8/0x1c8  [c24376c0] [c004c014] patch_instructions+0x15c/0x16c  [c2437710] [c00731a8] bpf_arch_text_copy+0x60/0x7c  [c2437730] [c0281168] bpf_jit_binary_pack_finalize+0x50/0xac  [c2437750] [c0073cf4] bpf_int_jit_compile+0xb30/0xdec  [c2437880] [c0280394] bpf_prog_select_runtime+0x15c/0x478  [c24378d0] [c1263428] bpf_prepare_filter+0xbf8/0xc14  [c2437990] [c12677ec] bpf_prog_create_from_user+0x258/0x2b4  [c24379d0] [c027111c] do_seccomp+0x3dc/0x1890  [c2437ac0] [c001d8e0] system_call_exception+0x2dc/0x420  [c2437f30] [c00281ac] ret_from_syscall+0x0/0x2c  --- interrupt: c00 at 0x5a1274  NIP:  005a1274 LR: 006a3b3c CTR: 005296c8  REGS: c2437f40 TRAP: 0c00   Tainted: G        W           (6.13.0-rc6-PMacG4)  MSR:  0200f932 <VEC,EE,PR,FP,ME,IR,DR,RI>  CR: 24004422  XER: 00000000  GPR00: 00000166 af8f3fa0 a7ee3540 00000001 00000000 013b6500 005a5858 0200f932  GPR08: 00000000 00001fe9 013d5fc8 005296c8 2822244c 00b2fcd8 00000000 af8f4b57  GPR16: 00000000 00000001 00000000 00000000 00000000 00000001 00000000 00000002  GPR24: 00afdbb0 00000000 00000000 00000000 006e0004 013ce060 006e7c1c 00000001  NIP [005a1274] 0x5a1274  LR [006a3b3c] 0x6a3b3c  --- interrupt: c00  The buggy address belongs to the virtual mapping at   [f1000000, f1002000) created by:   text_area_cpu_up+0x20/0x190  The buggy address belongs to the physical page:  page: refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x76e30  flags: 0x80000000(zone=2)  raw: 80000000 00000000 00000122 00000000 00000000 00000000 ffffffff 00000001  raw: 00000000  page dumped because: kasan: bad access detected  Memory state around the buggy address:   f0ffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   f0ffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  >f1000000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8             ^   f1000080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8   f1000100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8  ==================================================================f8 corresponds to KASAN_VMALLOC_INVALID which means the area is notinitialised hence not supposed to be used yet.Powerpc text patching infrastructure allocates a virtual memory areausing get_vm_area() and flags it as VM_ALLOC. But that flag is meantto be used for vmalloc() and vmalloc() allocated memory is notsupposed to be used before a call to __vmalloc_node_range() which isnever called for that area.That went undetected until commit e4137f08816b ( mm, kasan, kmsan:instrument copy_from/to_kernel_nofault )The area allocated by text_area_cpu_up() is not vmalloc memory, it ismapped directly on demand when needed by map_kernel_page(). There isno VM flag corresponding to such usage, so just pass no flag. That waythe area will be unpoisonned and usable immediately.
 openEuler评分：
  5.5
 Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4:受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS:受影响
5.openEuler-24.03-LTS-SP1:受影响
6.openEuler-24.03-LTS-SP2:不受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next:不受影响
9.openEuler-24.03-LTS-SP3:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.12.33):否
4.openEuler-24.03-LTS:否
5.openEuler-24.03-LTS-Next:否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否
9.openEuler-24.03-LTS-SP3:否

原因说明：
  1.openEuler-24.03-LTS:正常修复
2.openEuler-24.03-LTS-SP1:正常修复
3.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发
4.openEuler-20.03-LTS-SP4:不修复-超出修复范围
5.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
6.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
9.openEuler-24.03-LTS-SP3:不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel
Closed

Content Risk Flag

Comments (13)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-21866

Comments (13)

Search

src-openEuler/kernel
Closed