CVE-2025-22083

一、漏洞信息
 漏洞编号：[CVE-2025-22083](https://nvd.nist.gov/vuln/detail/CVE-2025-22083)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.x分值：
  BaseScore：7.8 High
  Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpointIf vhost_scsi_set_endpoint is called multiple times without avhost_scsi_clear_endpoint between them, we can hit multiple bugsfound by Haoran Zhang:1. Use-after-free when no tpgs are found:This fixes a use after free that occurs when vhost_scsi_set_endpoint iscalled more than once and calls after the first call do not find anytpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first findstpgs to add to the vs_tpg array match=true, so we will do:vhost_vq_set_backend(vq, vs_tpg);...kfree(vs->vs_tpg);vs->vs_tpg = vs_tpg;If vhost_scsi_set_endpoint is called again and no tpgs are foundmatch=false so we skip the vhost_vq_set_backend call leaving thepointer to the vs_tpg we then free via:kfree(vs->vs_tpg);vs->vs_tpg = vs_tpg;If a scsi request is then sent we do:vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backendwhich sees the vs_tpg we just did a kfree on.2. Tpg dir removal hang:This patch fixes an issue where we cannot remove a LIO/target layertpg (and structs above it like the target) dir due to the refcountdropping to -1.The problem is that if vhost_scsi_set_endpoint detects a tpg is alreadyin the vs->vs_tpg array or if the tpg has been removed sotarget_depend_item fails, the undepend goto handler will dotarget_undepend_item on all tpgs in the vs_tpg array dropping theirrefcount to 0. At this time vs_tpg contains both the tpgs we have addedin the current vhost_scsi_set_endpoint call as well as tpgs we added inprevious calls which are also in vs->vs_tpg.Later, when vhost_scsi_clear_endpoint runs it will dotarget_undepend_item on all the tpgs in the vs->vs_tpg which will droptheir refcount to -1. Userspace will then not be able to remove the tpgand will hang when it tries to do rmdir on the tpg dir.3. Tpg leak:This fixes a bug where we can leak tpgs and cause them to beun-removable because the target name is overwritten whenvhost_scsi_set_endpoint is called multiple times but with differenttarget names.The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setupa vhost-scsi device to target/tpg mapping, then callsVHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs wehaven t seen before (target1 has tpg1 but target2 has tpg2). When thishappens we don t teardown the old target tpg mapping and just overwritethe target name and the vs->vs_tpg array. Later when we dovhost_scsi_clear_endpoint, we are passed in either target1 or target2 sname and we will only match that target s tpgs when we loop over thevs->vs_tpg. We will then return from the function without doingtarget_undepend_item on the tpgs.Because of all these bugs, it looks like being able to callvhost_scsi_set_endpoint multiple times was never supported. The majoruser, QEMU, already has checks to prevent this use case. So to fix theissues, this patch prevents vhost_scsi_set_endpoint from being calledif it s already successfully added tpgs. To add, remove or change thetpg config or target name, you must do a vhost_scsi_clear_endpointfirst.
 漏洞公开时间：2025-04-16 23:16:02
 漏洞创建时间：2025-04-17 00:35:32
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-22083
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2b34bdc42df047794542f3e220fe989124e4499a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3a19eb3d9818e28f14c818a18dc913344a52ca92 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3fd054baf382a426bbf5135ede0fc5673db74d3e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/63b449f73ab0dcc0ba11ceaa4c5c70bc86ccf03c |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-22083 | https://bugzilla.suse.com/show_bug.cgi?id=1241414 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-22083 | https://bugzilla.suse.com/show_bug.cgi?id=1241414 |
| suse_bugzilla | https://git.kernel.org/stable/c/2b34bdc42df047794542f3e220fe989124e4499a | https://bugzilla.suse.com/show_bug.cgi?id=1241414 |
| suse_bugzilla | https://git.kernel.org/stable/c/3a19eb3d9818e28f14c818a18dc913344a52ca92 | https://bugzilla.suse.com/show_bug.cgi?id=1241414 |
| suse_bugzilla | https://git.kernel.org/stable/c/3fd054baf382a426bbf5135ede0fc5673db74d3e | https://bugzilla.suse.com/show_bug.cgi?id=1241414 |
| suse_bugzilla | https://git.kernel.org/stable/c/5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 | https://bugzilla.suse.com/show_bug.cgi?id=1241414 |
| suse_bugzilla | https://git.kernel.org/stable/c/63b449f73ab0dcc0ba11ceaa4c5c70bc86ccf03c | https://bugzilla.suse.com/show_bug.cgi?id=1241414 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-22083.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1241414 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-22083 |
| mageia |  | http://advisories.mageia.org/MGASA-2025-0142.html |
| osv | https://git.kernel.org/stable/c/2b34bdc42df047794542f3e220fe989124e4499a | https://osv.dev/vulnerability/CVE-2025-22083 |
| osv | https://git.kernel.org/stable/c/3a19eb3d9818e28f14c818a18dc913344a52ca92 | https://osv.dev/vulnerability/CVE-2025-22083 |
| osv | https://git.kernel.org/stable/c/3fd054baf382a426bbf5135ede0fc5673db74d3e | https://osv.dev/vulnerability/CVE-2025-22083 |
| osv | https://git.kernel.org/stable/c/5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 | https://osv.dev/vulnerability/CVE-2025-22083 |
| osv | https://git.kernel.org/stable/c/63b449f73ab0dcc0ba11ceaa4c5c70bc86ccf03c | https://osv.dev/vulnerability/CVE-2025-22083 |
| osv | https://security-tracker.debian.org/tracker/CVE-2025-22083 | https://osv.dev/vulnerability/CVE-2025-22083 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 6.6.87 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2b34bdc42df047794542f3e220fe989124e4499aIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 | linuxkernelcves |
| linux_kernel | 6.12.23 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3a19eb3d9818e28f14c818a18dc913344a52ca92Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 | linuxkernelcves |
| linux_kernel | 6.13.11 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3fd054baf382a426bbf5135ede0fc5673db74d3eIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 | linuxkernelcves |
| linux_kernel | 6.14.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=63b449f73ab0dcc0ba11ceaa4c5c70bc86ccf03cIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 | linuxkernelcves |
| linux_kernel | 6.15-rc1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6Please | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpointIf vhost_scsi_set_endpoint is called multiple times without avhost_scsi_clear_endpoint between them, we can hit multiple bugsfound by Haoran Zhang:1. Use-after-free when no tpgs are found:This fixes a use after free that occurs when vhost_scsi_set_endpoint iscalled more than once and calls after the first call do not find anytpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first findstpgs to add to the vs_tpg array match=true, so we will do:vhost_vq_set_backend(vq, vs_tpg);...kfree(vs-&gt;vs_tpg);vs-&gt;vs_tpg = vs_tpg;If vhost_scsi_set_endpoint is called again and no tpgs are foundmatch=false so we skip the vhost_vq_set_backend call leaving thepointer to the vs_tpg we then free via:kfree(vs-&gt;vs_tpg);vs-&gt;vs_tpg = vs_tpg;If a scsi request is then sent we do:vhost_scsi_handle_vq -&gt; vhost_scsi_get_req -&gt; vhost_vq_get_backendwhich sees the vs_tpg we just did a kfree on.2. Tpg dir removal hang:This patch fixes an issue where we cannot remove a LIO/target layertpg (and structs above it like the target) dir due to the refcountdropping to -1.The problem is that if vhost_scsi_set_endpoint detects a tpg is alreadyin the vs-&gt;vs_tpg array or if the tpg has been removed sotarget_depend_item fails, the undepend goto handler will dotarget_undepend_item on all tpgs in the vs_tpg array dropping theirrefcount to 0. At this time vs_tpg contains both the tpgs we have addedin the current vhost_scsi_set_endpoint call as well as tpgs we added inprevious calls which are also in vs-&gt;vs_tpg.Later, when vhost_scsi_clear_endpoint runs it will dotarget_undepend_item on all the tpgs in the vs-&gt;vs_tpg which will droptheir refcount to -1. Userspace will then not be able to remove the tpgand will hang when it tries to do rmdir on the tpg dir.3. Tpg leak:This fixes a bug where we can leak tpgs and cause them to beun-removable because the target name is overwritten whenvhost_scsi_set_endpoint is called multiple times but with differenttarget names.The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setupa vhost-scsi device to target/tpg mapping, then callsVHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs wehaven&#39;t seen before (target1 has tpg1 but target2 has tpg2). When thishappens we don&#39;t teardown the old target tpg mapping and just overwritethe target name and the vs-&gt;vs_tpg array. Later when we dovhost_scsi_clear_endpoint, we are passed in either target1 or target2&#39;sname and we will only match that target&#39;s tpgs when we loop over thevs-&gt;vs_tpg. We will then return from the function without doingtarget_undepend_item on the tpgs.Because of all these bugs, it looks like being able to callvhost_scsi_set_endpoint multiple times was never supported. The majoruser, QEMU, already has checks to prevent this use case. So to fix theissues, this patch prevents vhost_scsi_set_endpoint from being calledif it&#39;s already successfully added tpgs. To add, remove or change thetpg config or target name, you must do a vhost_scsi_clear_endpointfirst.The Linux kernel CVE team has assigned CVE-2025-22083 to this issue.
 openEuler评分：
  7.8
 Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4(5.10.0):受影响
5.openEuler-24.03-LTS(6.6.0):受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):受影响
8.openEuler-24.03-LTS-SP2(6.6.0):受影响
9.openEuler-24.03-LTS-SP3(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否
9.openEuler-24.03-LTS-SP3(6.6.0):否

原因说明：
  1.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4(4.19.90):暂不修复-暂无解决方案或补丁
3.openEuler-22.03-LTS-SP3(5.10.0):正常修复
4.openEuler-22.03-LTS-SP4(5.10.0):正常修复
5.openEuler-24.03-LTS(6.6.0):正常修复
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(6.6.0):正常修复
8.openEuler-24.03-LTS-SP2(6.6.0):正常修复
9.openEuler-24.03-LTS-SP3(6.6.0):不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel
关闭

内容风险标识

评论 (18)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-22083

评论 (18)

搜索帮助

src-openEuler/kernel
关闭