CVE-2025-21922

一、漏洞信息
 漏洞编号：[CVE-2025-21922](https://nvd.nist.gov/vuln/detail/CVE-2025-21922)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.x分值：
  BaseScore：5.5 Medium
  Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ppp: Fix KMSAN uninit-value warning with bpfSyzbot caught an  KMSAN: uninit-value  warning [1], which is caused by theppp driver not initializing a 2-byte header when using socket filter.The following code can generate a PPP filter BPF program:   struct bpf_program fp;pcap_t *handle;handle = pcap_open_dead(DLT_PPP_PPPD, 65535);pcap_compile(handle, &fp,  ip and outbound , 0, 0);bpf_dump(&fp, 1);   Its output is:   (000) ldh [2](001) jeq #0x21 jt 2 jf 5(002) ldb [0](003) jeq #0x1 jt 4 jf 5(004) ret #65535(005) ret #0   Wen can find similar code at the following link:https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680The maintainer of this code repository is also the original maintainerof the ppp driver.As you can see the BPF program skips 2 bytes of data and then reads the Protocol  field to determine if it s an IP packet. Then it read the firstbyte of the first 2 bytes to determine the direction.The issue is that only the first byte indicating direction is initializedin current ppp driver code while the second byte is not initialized.For normal BPF programs generated by libpcap, uninitialized data won t beused, so it s not a problem. However, for carefully crafted BPF programs,such as those generated by syzkaller [2], which start reading from offset0, the uninitialized data will be used and caught by KMSAN.[1] https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791[2] https://syzkaller.appspot.com/text?tag=ReproC&x=11994913980000
 漏洞公开时间：2025-04-02 00:15:22
 漏洞创建时间：2025-04-02 01:02:28
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-21922
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1eacd47636a9de5bee25d9d5962dc538a82d9f0b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2f591cb158807bdcf424f66f1fbfa6e4e50f3757 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3de809a768464528762757e433cd50de35bcb3c1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4c2d14c40a68678d885eab4008a0129646805bae |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4e2191b0fd0c064d37b0db67396216f2d4787e0f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/8aa8a40c766b3945b40565a70349d5581458ff63 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c036f5f2680cbdabdbbace86baee3c83721634d6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d685096c8129c9a92689975193e268945fd21dbf |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21922 | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21922.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| suse_bugzilla | https://git.kernel.org/stable/c/d685096c8129c9a92689975193e268945fd21dbf | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| suse_bugzilla | https://git.kernel.org/stable/c/2f591cb158807bdcf424f66f1fbfa6e4e50f3757 | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| suse_bugzilla | https://git.kernel.org/stable/c/4e2191b0fd0c064d37b0db67396216f2d4787e0f | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| suse_bugzilla | https://git.kernel.org/stable/c/3de809a768464528762757e433cd50de35bcb3c1 | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| suse_bugzilla | https://git.kernel.org/stable/c/1eacd47636a9de5bee25d9d5962dc538a82d9f0b | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| suse_bugzilla | https://git.kernel.org/stable/c/8aa8a40c766b3945b40565a70349d5581458ff63 | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| suse_bugzilla | https://git.kernel.org/stable/c/c036f5f2680cbdabdbbace86baee3c83721634d6 | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| suse_bugzilla | https://git.kernel.org/stable/c/4c2d14c40a68678d885eab4008a0129646805bae | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-21922 | https://bugzilla.suse.com/show_bug.cgi?id=1240639 |
| redhat_bugzilla | https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680 | https://bugzilla.redhat.com/show_bug.cgi?id=2356657 |
| redhat_bugzilla | https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791 | https://bugzilla.redhat.com/show_bug.cgi?id=2356657 |
| redhat_bugzilla | https://syzkaller.appspot.com/text?tag=ReproC&x=11994913980000 | https://bugzilla.redhat.com/show_bug.cgi?id=2356657 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21922-8c36@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2356657 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-21922 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/1eacd47636a9de5bee25d9d5962dc538a82d9f0b |  | nvd |
|  |  | https://git.kernel.org/stable/c/2f591cb158807bdcf424f66f1fbfa6e4e50f3757 |  | nvd |
|  |  | https://git.kernel.org/stable/c/3de809a768464528762757e433cd50de35bcb3c1 |  | nvd |
|  |  | https://git.kernel.org/stable/c/4c2d14c40a68678d885eab4008a0129646805bae |  | nvd |
|  |  | https://git.kernel.org/stable/c/4e2191b0fd0c064d37b0db67396216f2d4787e0f |  | nvd |
|  |  | https://git.kernel.org/stable/c/8aa8a40c766b3945b40565a70349d5581458ff63 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c036f5f2680cbdabdbbace86baee3c83721634d6 |  | nvd |
|  |  | https://git.kernel.org/stable/c/d685096c8129c9a92689975193e268945fd21dbf |  | nvd |
| linux_kernel | 5.4.291 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d685096c8129c9a92689975193e268945fd21dbfIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 5.10.235 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2f591cb158807bdcf424f66f1fbfa6e4e50f3757Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 5.15.179 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4e2191b0fd0c064d37b0db67396216f2d4787e0fIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 6.1.131 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3de809a768464528762757e433cd50de35bcb3c1Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 6.6.83 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1eacd47636a9de5bee25d9d5962dc538a82d9f0bIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 6.12.19 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8aa8a40c766b3945b40565a70349d5581458ff63Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 6.13.7 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c036f5f2680cbdabdbbace86baee3c83721634d6Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |
| linux_kernel | 6.14 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4c2d14c40a68678d885eab4008a0129646805baePlease | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:ppp: Fix KMSAN uninit-value warning with bpfSyzbot caught an &#34;KMSAN: uninit-value&#34; warning [1], which is caused by theppp driver not initializing a 2-byte header when using socket filter.The following code can generate a PPP filter BPF program:&#39;&#39;&#39;struct bpf_program fp;pcap_t *handle;handle = pcap_open_dead(DLT_PPP_PPPD, 65535);pcap_compile(handle, &#38;fp, &#34;ip and outbound&#34;, 0, 0);bpf_dump(&#38;fp, 1);&#39;&#39;&#39;Its output is:&#39;&#39;&#39;(000) ldh [2](001) jeq #0x21 jt 2 jf 5(002) ldb [0](003) jeq #0x1 jt 4 jf 5(004) ret #65535(005) ret #0&#39;&#39;&#39;Wen can find similar code at the following link:<ahref= https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680 >https://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680</a>The maintainer of this code repository is also the original maintainerof the ppp driver.As you can see the BPF program skips 2 bytes of data and then reads the&#39;Protocol&#39; field to determine if it&#39;s an IP packet. Then it read the firstbyte of the first 2 bytes to determine the direction.The issue is that only the first byte indicating direction is initializedin current ppp driver code while the second byte is not initialized.For normal BPF programs generated by libpcap, uninitialized data won&#39;t beused, so it&#39;s not a problem. However, for carefully crafted BPF programs,such as those generated by syzkaller [2], which start reading from offset0, the uninitialized data will be used and caught by KMSAN.[1] <ahref= https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791 >https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791</a>[2] <ahref= https://syzkaller.appspot.com/text?tag=ReproC&#38;x=11994913980000 >https://syzkaller.appspot.com/text?tag=ReproC&#38;x=11994913980000</a>The Linux kernel CVE team has assigned CVE-2025-21922 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4:受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS:受影响
5.openEuler-24.03-LTS-SP1:受影响
6.openEuler-24.03-LTS-SP2:不受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next:不受影响
9.openEuler-24.03-LTS-SP3:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.12.33):否
4.openEuler-24.03-LTS:否
5.openEuler-24.03-LTS-Next:否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否
9.openEuler-24.03-LTS-SP3:否

原因说明：
  1.openEuler-24.03-LTS:正常修复
2.openEuler-24.03-LTS-SP1:正常修复
3.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发
4.openEuler-20.03-LTS-SP4:不修复-超出修复范围
5.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
6.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
9.openEuler-24.03-LTS-SP3:不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel
Closed

Content Risk Flag

Comments (11)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-21922

Comments (11)

Search

src-openEuler/kernel
Closed