CVE-2025-22058

一、漏洞信息
 漏洞编号：[CVE-2025-22058](https://nvd.nist.gov/vuln/detail/CVE-2025-22058)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:udp: Fix memory accounting leak.Matt Dowling reported a weird UDP memory usage issue.Under normal operation, the UDP memory usage reported in /proc/net/sockstatremains close to zero.  However, it occasionally spiked to 524,288 pagesand never dropped.  Moreover, the value doubled when the application wasterminated.  Finally, it caused intermittent packet drops.We can reproduce the issue with the script below [0]:  1. /proc/net/sockstat reports 0 pages    # cat /proc/net/sockstat | grep UDP:    UDP: inuse 1 mem 0  2. Run the script till the report reaches 524,288    # python3 test.py & sleep 5    # cat /proc/net/sockstat | grep UDP:    UDP: inuse 3 mem 524288  <-- (INT_MAX + 1) >> PAGE_SHIFT  3. Kill the socket and confirm the number never drops    # pkill python3 && sleep 5    # cat /proc/net/sockstat | grep UDP:    UDP: inuse 1 mem 524288  4. (necessary since v6.0) Trigger proto_memory_pcpu_drain()    # python3 test.py & sleep 1 && pkill python3  5. The number doubles    # cat /proc/net/sockstat | grep UDP:    UDP: inuse 1 mem 1048577The application set INT_MAX to SO_RCVBUF, which triggered an integeroverflow in udp_rmem_release().When a socket is close()d, udp_destruct_common() purges its receivequeue and sums up skb->truesize in the queue.  This total is calculatedand stored in a local unsigned integer variable.The total size is then passed to udp_rmem_release() to adjust memoryaccounting.  However, because the function takes a signed integerargument, the total size can wrap around, causing an overflow.Then, the released amount is calculated as follows:  1) Add size to sk->sk_forward_alloc.  2) Round down sk->sk_forward_alloc to the nearest lower multiple of      PAGE_SIZE and assign it to amount.  3) Subtract amount from sk->sk_forward_alloc.  4) Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated().When the issue occurred, the total in udp_destruct_common() was 2147484480(INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release().At 1) sk->sk_forward_alloc is changed from 3264 to -2147479552, and2) sets -2147479552 to amount.  3) reverts the wraparound, so we don tsee a warning in inet_sock_destruct().  However, udp_memory_allocatedends up doubling at 4).Since commit 3cd3399dd7a8 ( net: implement per-cpu reserves formemory_allocated ), memory usage no longer doubles immediately aftera socket is close()d because __sk_mem_reduce_allocated() caches theamount in udp_memory_per_cpu_fw_alloc.  However, the next time a UDPsocket receives a packet, the subtraction takes effect, causing UDPmemory usage to double.This issue makes further memory allocation fail once the socket ssk->sk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packetdrops.To prevent this issue, let s use unsigned int for the calculation andcall sk_forward_alloc_add() only once for the small delta.Note that first_packet_length() also potentially has the same problem.[0]:from socket import *SO_RCVBUFFORCE = 33INT_MAX = (2 ** 31) - 1s = socket(AF_INET, SOCK_DGRAM)s.bind((  , 0))s.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX)c = socket(AF_INET, SOCK_DGRAM)c.connect(s.getsockname())data = b a  * 100while True:    c.send(data)
 漏洞公开时间：2025-04-16 23:15:59
 漏洞创建时间：2025-04-27 15:02:26
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-22058
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3836029448e76c1e6f77cc5fe0adc09b018b5fa8 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/9122fec396950cc866137af7154b1d0d989be52e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a116b271bf3cb72c8155b6b7f39083c1b80dcd00 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/aeef6456692c6f11ae53d278df64f1316a2a405a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c4bac6c398118fba79e32b1cd01db22dbfe29fbf |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/df207de9d9e7a4d92f8567e2c539d9c8c12fd99d |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-22058 | https://bugzilla.suse.com/show_bug.cgi?id=1241332 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-22058 | https://bugzilla.suse.com/show_bug.cgi?id=1241332 |
| suse_bugzilla | https://git.kernel.org/stable/c/3836029448e76c1e6f77cc5fe0adc09b018b5fa8 | https://bugzilla.suse.com/show_bug.cgi?id=1241332 |
| suse_bugzilla | https://git.kernel.org/stable/c/9122fec396950cc866137af7154b1d0d989be52e | https://bugzilla.suse.com/show_bug.cgi?id=1241332 |
| suse_bugzilla | https://git.kernel.org/stable/c/a116b271bf3cb72c8155b6b7f39083c1b80dcd00 | https://bugzilla.suse.com/show_bug.cgi?id=1241332 |
| suse_bugzilla | https://git.kernel.org/stable/c/aeef6456692c6f11ae53d278df64f1316a2a405a | https://bugzilla.suse.com/show_bug.cgi?id=1241332 |
| suse_bugzilla | https://git.kernel.org/stable/c/c4bac6c398118fba79e32b1cd01db22dbfe29fbf | https://bugzilla.suse.com/show_bug.cgi?id=1241332 |
| suse_bugzilla | https://git.kernel.org/stable/c/df207de9d9e7a4d92f8567e2c539d9c8c12fd99d | https://bugzilla.suse.com/show_bug.cgi?id=1241332 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-22058.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1241332 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025041606-CVE-2025-22058-045a@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2360276 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-22058 |
| mageia |  | http://advisories.mageia.org/MGASA-2025-0142.html |
| osv | https://git.kernel.org/stable/c/3836029448e76c1e6f77cc5fe0adc09b018b5fa8 | https://osv.dev/vulnerability/CVE-2025-22058 |
| osv | https://git.kernel.org/stable/c/9122fec396950cc866137af7154b1d0d989be52e | https://osv.dev/vulnerability/CVE-2025-22058 |
| osv | https://git.kernel.org/stable/c/a116b271bf3cb72c8155b6b7f39083c1b80dcd00 | https://osv.dev/vulnerability/CVE-2025-22058 |
| osv | https://git.kernel.org/stable/c/aeef6456692c6f11ae53d278df64f1316a2a405a | https://osv.dev/vulnerability/CVE-2025-22058 |
| osv | https://git.kernel.org/stable/c/c4bac6c398118fba79e32b1cd01db22dbfe29fbf | https://osv.dev/vulnerability/CVE-2025-22058 |
| osv | https://git.kernel.org/stable/c/df207de9d9e7a4d92f8567e2c539d9c8c12fd99d | https://osv.dev/vulnerability/CVE-2025-22058 |
| osv | https://security-tracker.debian.org/tracker/CVE-2025-22058 | https://osv.dev/vulnerability/CVE-2025-22058 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 6.1.134 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9122fec396950cc866137af7154b1d0d989be52eIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb | linuxkernelcves |
| linux_kernel | 6.6.87 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aeef6456692c6f11ae53d278df64f1316a2a405aIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb | linuxkernelcves |
| linux_kernel | 6.12.23 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a116b271bf3cb72c8155b6b7f39083c1b80dcd00Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb | linuxkernelcves |
| linux_kernel | 6.13.11 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c4bac6c398118fba79e32b1cd01db22dbfe29fbfIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb | linuxkernelcves |
| linux_kernel | 6.14.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3836029448e76c1e6f77cc5fe0adc09b018b5fa8Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb | linuxkernelcves |
| linux_kernel | 6.15-rc1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=df207de9d9e7a4d92f8567e2c539d9c8c12fd99dPlease | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:udp: Fix memory accounting leak.Matt Dowling reported a weird UDP memory usage issue.Under normal operation, the UDP memory usage reported in /proc/net/sockstatremains close to zero. However, it occasionally spiked to 524,288 pagesand never dropped. Moreover, the value doubled when the application wasterminated. Finally, it caused intermittent packet drops.We can reproduce the issue with the script below [0]:/proc/net/sockstat reports 0 pages# cat /proc/net/sockstat | grep UDP:UDP: inuse 1 mem 0Run the script till the report reaches 524,288# python3 test.py &#38; sleep 5# cat /proc/net/sockstat | grep UDP:UDP: inuse 3 mem 524288  &lt;-- (INT_MAX + 1) &gt;&gt; PAGE_SHIFTKill the socket and confirm the number never drops# pkill python3 &#38;&#38; sleep 5# cat /proc/net/sockstat | grep UDP:UDP: inuse 1 mem 524288(necessary since v6.0) Trigger proto_memory_pcpu_drain()# python3 test.py &#38; sleep 1 &#38;&#38; pkill python3The number doubles# cat /proc/net/sockstat | grep UDP:UDP: inuse 1 mem 1048577The application set INT_MAX to SO_RCVBUF, which triggered an integeroverflow in udp_rmem_release().When a socket is close()d, udp_destruct_common() purges its receivequeue and sums up skb->truesize in the queue. This total is calculatedand stored in a local unsigned integer variable.The total size is then passed to udp_rmem_release() to adjust memoryaccounting. However, because the function takes a signed integerargument, the total size can wrap around, causing an overflow.Then, the released amount is calculated as follows:Add size to sk->sk_forward_alloc.Round down sk->sk_forward_alloc to the nearest lower multiple ofPAGE_SIZE and assign it to amount.Subtract amount from sk->sk_forward_alloc.Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated().When the issue occurred, the total in udp_destruct_common() was 2147484480(INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release().At 1) sk->sk_forward_alloc is changed from 3264 to -2147479552, and2) sets -2147479552 to amount. 3) reverts the wraparound, so we don tsee a warning in inet_sock_destruct(). However, udp_memory_allocatedends up doubling at 4).Since commit 3cd3399dd7a8 ( net: implement per-cpu reserves formemory_allocated ), memory usage no longer doubles immediately aftera socket is close()d because __sk_mem_reduce_allocated() caches theamount in udp_memory_per_cpu_fw_alloc. However, the next time a UDPsocket receives a packet, the subtraction takes effect, causing UDPmemory usage to double.This issue makes further memory allocation fail once the socket ssk->sk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packetdrops.To prevent this issue, let s use unsigned int for the calculation andcall sk_forward_alloc_add() only once for the small delta.Note that first_packet_length() also potentially has the same problem.[0]:from socket import *SO_RCVBUFFORCE = 33INT_MAX = (2 ** 31) - 1s = socket(AF_INET, SOCK_DGRAM)s.bind((  , 0))s.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX)c = socket(AF_INET, SOCK_DGRAM)c.connect(s.getsockname())data = b a  * 100while True:c.send(data)The Linux kernel CVE team has assigned CVE-2025-22058 to this issue.
 openEuler评分：
  5.3
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3:受影响
3.openEuler-22.03-LTS-SP4:受影响
4.openEuler-24.03-LTS:受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP2(6.6.0):受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3:否
4.openEuler-22.03-LTS-SP4:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.openEuler-22.03-LTS-SP3:正常修复
3.openEuler-22.03-LTS-SP4:正常修复
4.openEuler-24.03-LTS:正常修复
5.openEuler-24.03-LTS-SP1(6.6.0):正常修复
6.openEuler-24.03-LTS-SP2(6.6.0):正常修复
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2082

src-openEuler/kernel
Closed

Content Risk Flag

Comments (13)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-22058

Comments (13)

Search

src-openEuler/kernel
Closed