CVE-2025-37761

一、漏洞信息
 漏洞编号：[CVE-2025-37761](https://nvd.nist.gov/vuln/detail/CVE-2025-37761)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:drm/xe: Fix an out-of-bounds shift when invalidating TLBWhen the size of the range invalidated is larger thanrounddown_pow_of_two(ULONG_MAX),The function macro roundup_pow_of_two(length) will hit an out-of-boundsshift [1].Use a full TLB invalidation for such cases.v2:- Use a define for the range size limit over which we use a full  TLB invalidation. (Lucas)- Use a better calculation of the limit.[1]:[   39.202421] ------------[ cut here ]------------[   39.202657] UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13[   39.202673] shift exponent 64 is too large for 64-bit type  long unsigned int [   39.202688] CPU: 8 UID: 0 PID: 3129 Comm: xe_exec_system_ Tainted: G     U             6.14.0+ #10[   39.202690] Tainted: [U]=USER[   39.202690] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 2001 02/01/2023[   39.202691] Call Trace:[   39.202692]  <TASK>[   39.202695]  dump_stack_lvl+0x6e/0xa0[   39.202699]  ubsan_epilogue+0x5/0x30[   39.202701]  __ubsan_handle_shift_out_of_bounds.cold+0x61/0xe6[   39.202705]  xe_gt_tlb_invalidation_range.cold+0x1d/0x3a [xe][   39.202800]  ? find_held_lock+0x2b/0x80[   39.202803]  ? mark_held_locks+0x40/0x70[   39.202806]  xe_svm_invalidate+0x459/0x700 [xe][   39.202897]  drm_gpusvm_notifier_invalidate+0x4d/0x70 [drm_gpusvm][   39.202900]  __mmu_notifier_release+0x1f5/0x270[   39.202905]  exit_mmap+0x40e/0x450[   39.202912]  __mmput+0x45/0x110[   39.202914]  exit_mm+0xc5/0x130[   39.202916]  do_exit+0x21c/0x500[   39.202918]  ? lockdep_hardirqs_on_prepare+0xdb/0x190[   39.202920]  do_group_exit+0x36/0xa0[   39.202922]  get_signal+0x8f8/0x900[   39.202926]  arch_do_signal_or_restart+0x35/0x100[   39.202930]  syscall_exit_to_user_mode+0x1fc/0x290[   39.202932]  do_syscall_64+0xa1/0x180[   39.202934]  ? do_user_addr_fault+0x59f/0x8a0[   39.202937]  ? lock_release+0xd2/0x2a0[   39.202939]  ? do_user_addr_fault+0x5a9/0x8a0[   39.202942]  ? trace_hardirqs_off+0x4b/0xc0[   39.202944]  ? clear_bhb_loop+0x25/0x80[   39.202946]  ? clear_bhb_loop+0x25/0x80[   39.202947]  ? clear_bhb_loop+0x25/0x80[   39.202950]  entry_SYSCALL_64_after_hwframe+0x76/0x7e[   39.202952] RIP: 0033:0x7fa945e543e1[   39.202961] Code: Unable to access opcode bytes at 0x7fa945e543b7.[   39.202962] RSP: 002b:00007ffca8fb4170 EFLAGS: 00000293[   39.202963] RAX: 000000000000003d RBX: 0000000000000000 RCX: 00007fa945e543e3[   39.202964] RDX: 0000000000000000 RSI: 00007ffca8fb41ac RDI: 00000000ffffffff[   39.202964] RBP: 00007ffca8fb4190 R08: 0000000000000000 R09: 00007fa945f600a0[   39.202965] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000[   39.202966] R13: 00007fa9460dd310 R14: 00007ffca8fb41ac R15: 0000000000000000[   39.202970]  </TASK>[   39.202970] ---[ end trace ]---(cherry picked from commit b88f48f86500bc0b44b4f73ac66d500a40d320ad)
 漏洞公开时间：2025-05-01 22:15:38
 漏洞创建时间：2025-05-01 22:53:29
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-37761
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/28477f701b63922ff88e9fb13f5519c11cd48b86 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7bcfeddb36b77f9fe3b010bb0b282b7618420bba |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e4715858f87b78ce58cfa03bbe140321edbbaf20 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-37761 | https://bugzilla.suse.com/show_bug.cgi?id=1242724 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-37761.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1242724 |
| suse_bugzilla | https://git.kernel.org/stable/c/28477f701b63922ff88e9fb13f5519c11cd48b86 | https://bugzilla.suse.com/show_bug.cgi?id=1242724 |
| suse_bugzilla | https://git.kernel.org/stable/c/e4715858f87b78ce58cfa03bbe140321edbbaf20 | https://bugzilla.suse.com/show_bug.cgi?id=1242724 |
| suse_bugzilla | https://git.kernel.org/stable/c/7bcfeddb36b77f9fe3b010bb0b282b7618420bba | https://bugzilla.suse.com/show_bug.cgi?id=1242724 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-37761 | https://bugzilla.suse.com/show_bug.cgi?id=1242724 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2363318 | https://bugzilla.suse.com/show_bug.cgi?id=1242724 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025050110-CVE-2025-37761-f71c@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2363318 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-37761 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:drm/xe: Fix an out-of-bounds shift when invalidating TLBWhen the size of the range invalidated is larger thanrounddown_pow_of_two(ULONG_MAX),The function macro roundup_pow_of_two(length) will hit an out-of-boundsshift [1].Use a full TLB invalidation for such cases.v2:- Use a define for the range size limit over which we use a full  TLB invalidation. (Lucas)- Use a better calculation of the limit.[1]:[   39.202421] ------------[ cut here ]------------[   39.202657] UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13[   39.202673] shift exponent 64 is too large for 64-bit type &#39;long unsigned int&#39;[   39.202688] CPU: 8 UID: 0 PID: 3129 Comm: xe_exec_system_ Tainted: G     U             6.14.0+ #10[   39.202690] Tainted: [U]=USER[   39.202690] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 2001 02/01/2023[   39.202691] Call Trace:[   39.202692]  &lt;TASK&gt;[   39.202695]  dump_stack_lvl+0x6e/0xa0[   39.202699]  ubsan_epilogue+0x5/0x30[   39.202701]  __ubsan_handle_shift_out_of_bounds.cold+0x61/0xe6[   39.202705]  xe_gt_tlb_invalidation_range.cold+0x1d/0x3a [xe][   39.202800]  ? find_held_lock+0x2b/0x80[   39.202803]  ? mark_held_locks+0x40/0x70[   39.202806]  xe_svm_invalidate+0x459/0x700 [xe][   39.202897]  drm_gpusvm_notifier_invalidate+0x4d/0x70 [drm_gpusvm][   39.202900]  __mmu_notifier_release+0x1f5/0x270[   39.202905]  exit_mmap+0x40e/0x450[   39.202912]  __mmput+0x45/0x110[   39.202914]  exit_mm+0xc5/0x130[   39.202916]  do_exit+0x21c/0x500[   39.202918]  ? lockdep_hardirqs_on_prepare+0xdb/0x190[   39.202920]  do_group_exit+0x36/0xa0[   39.202922]  get_signal+0x8f8/0x900[   39.202926]  arch_do_signal_or_restart+0x35/0x100[   39.202930]  syscall_exit_to_user_mode+0x1fc/0x290[   39.202932]  do_syscall_64+0xa1/0x180[   39.202934]  ? do_user_addr_fault+0x59f/0x8a0[   39.202937]  ? lock_release+0xd2/0x2a0[   39.202939]  ? do_user_addr_fault+0x5a9/0x8a0[   39.202942]  ? trace_hardirqs_off+0x4b/0xc0[   39.202944]  ? clear_bhb_loop+0x25/0x80[   39.202946]  ? clear_bhb_loop+0x25/0x80[   39.202947]  ? clear_bhb_loop+0x25/0x80[   39.202950]  entry_SYSCALL_64_after_hwframe+0x76/0x7e[   39.202952] RIP: 0033:0x7fa945e543e1[   39.202961] Code: Unable to access opcode bytes at 0x7fa945e543b7.[   39.202962] RSP: 002b:00007ffca8fb4170 EFLAGS: 00000293[   39.202963] RAX: 000000000000003d RBX: 0000000000000000 RCX: 00007fa945e543e3[   39.202964] RDX: 0000000000000000 RSI: 00007ffca8fb41ac RDI: 00000000ffffffff[   39.202964] RBP: 00007ffca8fb4190 R08: 0000000000000000 R09: 00007fa945f600a0[   39.202965] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000[   39.202966] R13: 00007fa9460dd310 R14: 00007ffca8fb41ac R15: 0000000000000000[   39.202970]  &lt;/TASK&gt;[   39.202970] ---[ end trace ]---(cherry picked from commit b88f48f86500bc0b44b4f73ac66d500a40d320ad)The Linux kernel CVE team has assigned CVE-2025-37761 to this issue.
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.master:不受影响
2.openEuler-20.03-LTS-SP4:不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master:否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.master:不受影响-漏洞代码不能被攻击者触发
2.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-20.03-LTS-SP4:不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响-漏洞代码不存在

src-openEuler/kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-37761

Comments (7)

Search

src-openEuler/kernel
Closed