CVE-2025-22035

一、漏洞信息
 漏洞编号：[CVE-2025-22035](https://nvd.nist.gov/vuln/detail/CVE-2025-22035)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:tracing: Fix use-after-free in print_graph_function_flags during tracer switchingKairui reported a UAF issue in print_graph_function_flags() duringftrace stress testing [1]. This issue can be reproduced if puting a mdelay(10)  after  mutex_unlock(&trace_types_lock)  in s_start(),and executing the following script:  $ echo function_graph > current_tracer  $ cat trace > /dev/null &  $ sleep 5  # Ensure the  cat  reaches the  mdelay(10)  point  $ echo timerlat > current_tracerThe root cause lies in the two calls to print_graph_function_flagswithin print_trace_line during each s_show():  * One through  iter->trace->print_line() ;  * Another through  event->funcs->trace() , which is hidden in    print_trace_fmt() before print_trace_line returns.Tracer switching only updates the former, while the latter continuesto use the print_line function of the old tracer, which in the scriptabove is print_graph_function_flags.Moreover, when switching from the  function_graph  tracer to the timerlat  tracer, s_start only calls graph_trace_close of the function_graph  tracer to free  iter->private , but does not setit to NULL. This provides an opportunity for  event->funcs->trace() to use an invalid  iter->private .To fix this issue, set  iter->private  to NULL immediately afterfreeing it in graph_trace_close(), ensuring that an invalid pointeris not passed to other tracers. Additionally, clean up the unnecessary iter->private = NULL  during each  cat trace  when using wakeup andirqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/
 漏洞公开时间：2025-04-16 23:15:56
 漏洞创建时间：2025-04-17 00:31:50
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-22035
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-22035 | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-22035 | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906 | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813 | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70 | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-22035.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2360210 | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| suse_bugzilla | https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025-22035.json | https://bugzilla.suse.com/show_bug.cgi?id=1241544 |
| redhat_bugzilla | https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ | https://bugzilla.redhat.com/show_bug.cgi?id=2360210 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025041658-CVE-2025-22035-b50c@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2360210 |
| osv | https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a | https://osv.dev/vulnerability/CVE-2025-22035 |
| osv | https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f | https://osv.dev/vulnerability/CVE-2025-22035 |
| osv | https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb | https://osv.dev/vulnerability/CVE-2025-22035 |
| osv | https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906 | https://osv.dev/vulnerability/CVE-2025-22035 |
| osv | https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b | https://osv.dev/vulnerability/CVE-2025-22035 |
| osv | https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e | https://osv.dev/vulnerability/CVE-2025-22035 |
| osv | https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a | https://osv.dev/vulnerability/CVE-2025-22035 |
| osv | https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813 | https://osv.dev/vulnerability/CVE-2025-22035 |
| osv | https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70 | https://osv.dev/vulnerability/CVE-2025-22035 |
| osv | https://security-tracker.debian.org/tracker/CVE-2025-22035 | https://osv.dev/vulnerability/CVE-2025-22035 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2025-22035 | https://explore.alas.aws.amazon.com/CVE-2025-22035.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22035 | https://explore.alas.aws.amazon.com/CVE-2025-22035.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a |  | nvd |
|  |  | https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f |  | nvd |
|  |  | https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb |  | nvd |
|  |  | https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906 |  | nvd |
|  |  | https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b |  | nvd |
|  |  | https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e |  | nvd |
|  |  | https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a |  | nvd |
|  |  | https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813 |  | nvd |
|  |  | https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70 |  | nvd |
| linux_kernel | 5.4.292 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=42561fe62c3628ea3bc9623f64f047605e98857fIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=05319d707732c728eb721ac616a50e7978eb499a | linuxkernelcves |
| linux_kernel | 5.10.236 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=de7b309139f862a44379ecd96e93c9133c69f813Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=05319d707732c728eb721ac616a50e7978eb499a | linuxkernelcves |
| linux_kernel | 5.15.180 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=81a85b12132c8ffe98f5ddbdc185481790aeaa1bIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=05319d707732c728eb721ac616a50e7978eb499a | linuxkernelcves |
| linux_kernel | 6.1.134 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a2cce54c1748216535dda02e185d07a084be837eIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=05319d707732c728eb721ac616a50e7978eb499a | linuxkernelcves |
| linux_kernel | 6.6.87 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=099ef3385800828b74933a96c117574637c3fb3aIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=05319d707732c728eb721ac616a50e7978eb499a | linuxkernelcves |
| linux_kernel | 6.12.23 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c85efe6e13743cac6ba4ccf144cb91f44c86231aIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=05319d707732c728eb721ac616a50e7978eb499a | linuxkernelcves |
| linux_kernel | 6.13.11 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f14752d66056d0c7bffe5092130409417d3baa70Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=05319d707732c728eb721ac616a50e7978eb499a | linuxkernelcves |
| linux_kernel | 6.14.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=70be951bc01e4a0e10d443f3510bb17426f257fbIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=05319d707732c728eb721ac616a50e7978eb499a | linuxkernelcves |
| linux_kernel | 6.15-rc1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7f81f27b1093e4895e87b74143c59c055c3b1906Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=05319d707732c728eb721ac616a50e7978eb499a | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:tracing: Fix use-after-free in print_graph_function_flags during tracer switchingKairui reported a UAF issue in print_graph_function_flags() duringftrace stress testing [1]. This issue can be reproduced if puting a&#39;mdelay(10)&#39; after &#39;mutex_unlock(&#38;trace_types_lock)&#39; in s_start(),and executing the following script:  $ echo function_graph &gt; current_tracer  $ cat trace &gt; /dev/null &#38;  $ sleep 5  # Ensure the &#39;cat&#39; reaches the &#39;mdelay(10)&#39; point  $ echo timerlat &gt; current_tracerThe root cause lies in the two calls to print_graph_function_flagswithin print_trace_line during each s_show():  * One through &#39;iter-&gt;trace-&gt;print_line()&#39;;  * Another through &#39;event-&gt;funcs-&gt;trace()&#39;, which is hidden in    print_trace_fmt() before print_trace_line returns.Tracer switching only updates the former, while the latter continuesto use the print_line function of the old tracer, which in the scriptabove is print_graph_function_flags.Moreover, when switching from the &#39;function_graph&#39; tracer to the&#39;timerlat&#39; tracer, s_start only calls graph_trace_close of the&#39;function_graph&#39; tracer to free &#39;iter-&gt;private&#39;, but does not setit to NULL. This provides an opportunity for &#39;event-&gt;funcs-&gt;trace()&#39;to use an invalid &#39;iter-&gt;private&#39;.To fix this issue, set &#39;iter-&gt;private&#39; to NULL immediately afterfreeing it in graph_trace_close(), ensuring that an invalid pointeris not passed to other tracers. Additionally, clean up the unnecessary&#39;iter-&gt;private = NULL&#39; during each &#39;cat trace&#39; when using wakeup andirqsoff tracers. [1] <ahref= https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ >https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/</a>The Linux kernel CVE team has assigned CVE-2025-22035 to this issue.
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.6.0):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.openEuler-22.03-LTS-SP4(5.10.0):正常修复
3.openEuler-24.03-LTS(6.6.0):正常修复
4.openEuler-24.03-LTS-SP1(6.6.0):正常修复
5.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
6.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

src-openEuler / kernel
Closed

Content Risk Flag

Comments (11)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-22035

Comments (11)

Search

src-openEuler / kernel
Closed