CVE-2025-21959

一、漏洞信息
 漏洞编号：[CVE-2025-21959](https://nvd.nist.gov/vuln/detail/CVE-2025-21959)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()Since commit b36e4523d4d5 ( netfilter: nf_conncount: fix garbagecollection confirm race ), `cpu` and `jiffies32` were introduced tothe struct nf_conncount_tuple.The commit made nf_conncount_add() initialize `conn->cpu` and`conn->jiffies32` when allocating the struct.In contrast, count_tree() was not changed to initialize them.By commit 34848d5c896e ( netfilter: nf_conncount: Split insert andtraversal ), count_tree() was split and the relevant allocationcode now resides in insert_tree().Initialize `conn->cpu` and `conn->jiffies32` in insert_tree().BUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline]BUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 find_or_evict net/netfilter/nf_conncount.c:117 [inline] __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 count_tree net/netfilter/nf_conncount.c:438 [inline] nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8eUninit was created at: slab_post_alloc_hook mm/slub.c:4121 [inline] slab_alloc_node mm/slub.c:4164 [inline] kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171 insert_tree net/netfilter/nf_conncount.c:372 [inline] count_tree net/netfilter/nf_conncount.c:450 [inline] nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ip---truncated---
 漏洞公开时间：2025-04-02 00:15:27
 漏洞创建时间：2025-04-02 01:06:38
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-21959
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2a154ce766b995494e88d8d117fa82cc6b73dd87 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a62a25c6ad58fae997f48a0749afeda1c252ae51 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d653bfeb07ebb3499c403404c21ac58a16531607 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/db1e0c0856821c59a32ea3af79476bf20a6beeb2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e8544a5a97bee3674e7cd6bf0f3a4af517fa9146 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f522229c5563b59b4240261e406779bba6754159 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fda50302a13701d47fbe01e1739c7a51114144fb |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21959 | https://bugzilla.suse.com/show_bug.cgi?id=1240814 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-21959 | https://bugzilla.suse.com/show_bug.cgi?id=1240814 |
| suse_bugzilla | https://git.kernel.org/stable/c/2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc | https://bugzilla.suse.com/show_bug.cgi?id=1240814 |
| suse_bugzilla | https://git.kernel.org/stable/c/a62a25c6ad58fae997f48a0749afeda1c252ae51 | https://bugzilla.suse.com/show_bug.cgi?id=1240814 |
| suse_bugzilla | https://git.kernel.org/stable/c/d653bfeb07ebb3499c403404c21ac58a16531607 | https://bugzilla.suse.com/show_bug.cgi?id=1240814 |
| suse_bugzilla | https://git.kernel.org/stable/c/db1e0c0856821c59a32ea3af79476bf20a6beeb2 | https://bugzilla.suse.com/show_bug.cgi?id=1240814 |
| suse_bugzilla | https://git.kernel.org/stable/c/fda50302a13701d47fbe01e1739c7a51114144fb | https://bugzilla.suse.com/show_bug.cgi?id=1240814 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2356610 | https://bugzilla.suse.com/show_bug.cgi?id=1240814 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21959.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1240814 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025040144-CVE-2025-21959-a643@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2356610 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-21959 |
| osv | https://git.kernel.org/stable/c/2a154ce766b995494e88d8d117fa82cc6b73dd87 | https://osv.dev/vulnerability/CVE-2025-21959 |
| osv | https://git.kernel.org/stable/c/2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc | https://osv.dev/vulnerability/CVE-2025-21959 |
| osv | https://git.kernel.org/stable/c/a62a25c6ad58fae997f48a0749afeda1c252ae51 | https://osv.dev/vulnerability/CVE-2025-21959 |
| osv | https://git.kernel.org/stable/c/d653bfeb07ebb3499c403404c21ac58a16531607 | https://osv.dev/vulnerability/CVE-2025-21959 |
| osv | https://git.kernel.org/stable/c/db1e0c0856821c59a32ea3af79476bf20a6beeb2 | https://osv.dev/vulnerability/CVE-2025-21959 |
| osv | https://git.kernel.org/stable/c/e8544a5a97bee3674e7cd6bf0f3a4af517fa9146 | https://osv.dev/vulnerability/CVE-2025-21959 |
| osv | https://git.kernel.org/stable/c/f522229c5563b59b4240261e406779bba6754159 | https://osv.dev/vulnerability/CVE-2025-21959 |
| osv | https://git.kernel.org/stable/c/fda50302a13701d47fbe01e1739c7a51114144fb | https://osv.dev/vulnerability/CVE-2025-21959 |
| osv | https://security-tracker.debian.org/tracker/CVE-2025-21959 | https://osv.dev/vulnerability/CVE-2025-21959 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/2a154ce766b995494e88d8d117fa82cc6b73dd87 |  | nvd |
|  |  | https://git.kernel.org/stable/c/2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc |  | nvd |
|  |  | https://git.kernel.org/stable/c/a62a25c6ad58fae997f48a0749afeda1c252ae51 |  | nvd |
|  |  | https://git.kernel.org/stable/c/d653bfeb07ebb3499c403404c21ac58a16531607 |  | nvd |
|  |  | https://git.kernel.org/stable/c/db1e0c0856821c59a32ea3af79476bf20a6beeb2 |  | nvd |
|  |  | https://git.kernel.org/stable/c/e8544a5a97bee3674e7cd6bf0f3a4af517fa9146 |  | nvd |
|  |  | https://git.kernel.org/stable/c/f522229c5563b59b4240261e406779bba6754159 |  | nvd |
|  |  | https://git.kernel.org/stable/c/fda50302a13701d47fbe01e1739c7a51114144fb |  | nvd |
| linux_kernel | 6.1.132 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a62a25c6ad58fae997f48a0749afeda1c252ae51Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 | linuxkernelcves |
| linux_kernel | 6.6.84 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fda50302a13701d47fbe01e1739c7a51114144fbIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 | linuxkernelcves |
| linux_kernel | 6.12.20 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=db1e0c0856821c59a32ea3af79476bf20a6beeb2Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 | linuxkernelcves |
| linux_kernel | 6.13.8 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2db5baaf047a7c8d6ed5e2cc657b7854e155b7fcIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 | linuxkernelcves |
| linux_kernel | 6.14 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d653bfeb07ebb3499c403404c21ac58a16531607Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                            In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()Since commit b36e4523d4d5 (&#34;netfilter: nf_conncount: fix garbagecollection confirm race&#34;), `cpu` and `jiffies32` were introduced tothe struct nf_conncount_tuple.The commit made nf_conncount_add() initialize `conn-&gt;cpu` and`conn-&gt;jiffies32` when allocating the struct.In contrast, count_tree() was not changed to initialize them.By commit 34848d5c896e (&#34;netfilter: nf_conncount: Split insert andtraversal&#34;), count_tree() was split and the relevant allocationcode now resides in insert_tree().Initialize `conn-&gt;cpu` and `conn-&gt;jiffies32` in insert_tree().BUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline]BUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 find_or_evict net/netfilter/nf_conncount.c:117 [inline] __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 count_tree net/netfilter/nf_conncount.c:438 [inline] nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8eUninit was created at: slab_post_alloc_hook mm/slub.c:4121 [inline] slab_alloc_node mm/slub.c:4164 [inline] kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171 insert_tree net/netfilter/nf_conncount.c:372 [inline] count_tree net/netfilter/nf_conncount.c:450 [inline] nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/de
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS:受影响
5.openEuler-24.03-LTS-SP1:受影响
6.openEuler-24.03-LTS-SP2:受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
  1.openEuler-24.03-LTS:正常修复
2.openEuler-24.03-LTS-SP1:正常修复
3.openEuler-24.03-LTS-SP2:正常修复
4.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
5.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
6.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel
关闭

内容风险标识

评论 (11)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-21959

评论 (11)

搜索帮助

src-openEuler/kernel
关闭