CVE-2025-22062

一、漏洞信息
 漏洞编号：[CVE-2025-22062](https://nvd.nist.gov/vuln/detail/CVE-2025-22062)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:sctp: add mutual exclusion in proc_sctp_do_udp_port()We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start()or risk a crash as syzbot reported:Oops: general protection fault, probably for non-canonical address 0xdffffc000000000d: 0000 [#1] SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]CPU: 1 UID: 0 PID: 6551 Comm: syz.1.44 Not tainted 6.14.0-syzkaller-g7f2ff7b62617 #0 PREEMPT(full)Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:kernel_sock_shutdown+0x47/0x70 net/socket.c:3653Call Trace: <TASK>  udp_tunnel_sock_release+0x68/0x80 net/ipv4/udp_tunnel_core.c:181  sctp_udp_sock_stop+0x71/0x160 net/sctp/protocol.c:930  proc_sctp_do_udp_port+0x264/0x450 net/sctp/sysctl.c:553  proc_sys_call_handler+0x3d0/0x5b0 fs/proc/proc_sysctl.c:601  iter_file_splice_write+0x91c/0x1150 fs/splice.c:738  do_splice_from fs/splice.c:935 [inline]  direct_splice_actor+0x18f/0x6c0 fs/splice.c:1158  splice_direct_to_actor+0x342/0xa30 fs/splice.c:1102  do_splice_direct_actor fs/splice.c:1201 [inline]  do_splice_direct+0x174/0x240 fs/splice.c:1227  do_sendfile+0xafd/0xe50 fs/read_write.c:1368  __do_sys_sendfile64 fs/read_write.c:1429 [inline]  __se_sys_sendfile64 fs/read_write.c:1415 [inline]  __x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1415  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 漏洞公开时间：2025-04-16 23:15:59
 漏洞创建时间：2025-04-17 00:48:43
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-22062
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/10206302af856791fbcc27a33ed3c3eb09b2793d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/386507cb6fb7cdef598ddcb3f0fa37e6ca9e789d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/65ccb2793da7401772a3ffe85355c831b313c59f |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b3598f53211ba1025485306de2733bdd241311a3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d3d7675d77622f6ca1aae14c51f80027b36283f8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e5178bfc55b3a78000f0f8298e7ade88783ce581 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/efb8cb487be8f4ba6aaef616011d702d6a083ed1 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-22062 | https://bugzilla.suse.com/show_bug.cgi?id=1241412 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-22062 | https://bugzilla.suse.com/show_bug.cgi?id=1241412 |
| suse_bugzilla | https://git.kernel.org/stable/c/10206302af856791fbcc27a33ed3c3eb09b2793d | https://bugzilla.suse.com/show_bug.cgi?id=1241412 |
| suse_bugzilla | https://git.kernel.org/stable/c/d3d7675d77622f6ca1aae14c51f80027b36283f8 | https://bugzilla.suse.com/show_bug.cgi?id=1241412 |
| suse_bugzilla | https://git.kernel.org/stable/c/e5178bfc55b3a78000f0f8298e7ade88783ce581 | https://bugzilla.suse.com/show_bug.cgi?id=1241412 |
| suse_bugzilla | https://git.kernel.org/stable/c/efb8cb487be8f4ba6aaef616011d702d6a083ed1 | https://bugzilla.suse.com/show_bug.cgi?id=1241412 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-22062.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1241412 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2360275 | https://bugzilla.suse.com/show_bug.cgi?id=1241412 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025041607-CVE-2025-22062-8912@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2360275 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-22062 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/10206302af856791fbcc27a33ed3c3eb09b2793d |  | nvd |
|  |  | https://git.kernel.org/stable/c/d3d7675d77622f6ca1aae14c51f80027b36283f8 |  | nvd |
|  |  | https://git.kernel.org/stable/c/e5178bfc55b3a78000f0f8298e7ade88783ce581 |  | nvd |
|  |  | https://git.kernel.org/stable/c/efb8cb487be8f4ba6aaef616011d702d6a083ed1 |  | nvd |
| linux_kernel | 6.12.23 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e5178bfc55b3a78000f0f8298e7ade88783ce581 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=046c052b475e7119b6a30e3483e2888fc606a2f8 | linuxkernelcves |
| linux_kernel | 6.13.11 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=efb8cb487be8f4ba6aaef616011d702d6a083ed1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=046c052b475e7119b6a30e3483e2888fc606a2f8 | linuxkernelcves |
| linux_kernel | 6.14.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d3d7675d77622f6ca1aae14c51f80027b36283f8 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=046c052b475e7119b6a30e3483e2888fc606a2f8 | linuxkernelcves |
| linux_kernel | 6.15-rc1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=10206302af856791fbcc27a33ed3c3eb09b2793d | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=046c052b475e7119b6a30e3483e2888fc606a2f8 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:sctp: add mutual exclusion in proc_sctp_do_udp_port()We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start()or risk a crash as syzbot reported:Oops: general protection fault, probably for non-canonical address 0xdffffc000000000d: 0000 [#1] SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]CPU: 1 UID: 0 PID: 6551 Comm: syz.1.44 Not tainted 6.14.0-syzkaller-g7f2ff7b62617 #0 PREEMPT(full)Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:kernel_sock_shutdown+0x47/0x70 net/socket.c:3653Call Trace: &lt;TASK&gt;  udp_tunnel_sock_release+0x68/0x80 net/ipv4/udp_tunnel_core.c:181  sctp_udp_sock_stop+0x71/0x160 net/sctp/protocol.c:930  proc_sctp_do_udp_port+0x264/0x450 net/sctp/sysctl.c:553  proc_sys_call_handler+0x3d0/0x5b0 fs/proc/proc_sysctl.c:601  iter_file_splice_write+0x91c/0x1150 fs/splice.c:738  do_splice_from fs/splice.c:935 [inline]  direct_splice_actor+0x18f/0x6c0 fs/splice.c:1158  splice_direct_to_actor+0x342/0xa30 fs/splice.c:1102  do_splice_direct_actor fs/splice.c:1201 [inline]  do_splice_direct+0x174/0x240 fs/splice.c:1227  do_sendfile+0xafd/0xe50 fs/read_write.c:1368  __do_sys_sendfile64 fs/read_write.c:1429 [inline]  __se_sys_sendfile64 fs/read_write.c:1415 [inline]  __x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1415  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]The Linux kernel CVE team has assigned CVE-2025-22062 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-24.03-LTS-SP1(6.6.0):受影响
3.openEuler-24.03-LTS-SP2(6.6.0):受影响
4.master(6.12.33):不受影响
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响
6.openEuler-22.03-LTS-SP3(5.10.0):不受影响
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1880

src-openEuler/kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-22062

Comments (7)

Search

src-openEuler/kernel
Closed