CVE-2025-37824

一、漏洞信息
 漏洞编号：[CVE-2025-37824](https://nvd.nist.gov/vuln/detail/CVE-2025-37824)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:tipc: fix NULL pointer dereference in tipc_mon_reinit_self()syzbot reported:tipc: Node number set to 1055423674Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 3 UID: 0 PID: 6017 Comm: kworker/3:5 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(full)Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014Workqueue: events tipc_net_finalize_workRIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719...RSP: 0018:ffffc9000356fb68 EFLAGS: 00010246RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cbaRDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007R13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010FS:  0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: <TASK> tipc_net_finalize+0x10b/0x180 net/tipc/net.c:140 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>...RIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719...RSP: 0018:ffffc9000356fb68 EFLAGS: 00010246RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cbaRDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007R13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010FS:  0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400There is a racing condition between workqueue created when enablingbearer and another thread created when disabling bearer right afterthat as follow:enabling_bearer                          | disabling_bearer---------------                          | ----------------tipc_disc_timeout()                      |{                                        | bearer_disable() ...                                     | { schedule_work(&tn->work);               |  tipc_mon_delete() ...                                     |  {}                                        |   ...                                         |   write_lock_bh(&mon->lock);                                         |   mon->self = NULL;                                         |   write_unlock_bh(&mon->lock);                                         |   ...                                         |  }tipc_net_finalize_work()                 | }{                                        | ...                                     | tipc_net_finalize()                     | {                                       |  ...                                    |  tipc_mon_reinit_self()                 |  {                                      |   ...                                   |   write_lock_bh(&mon->lock);            |   mon->self->addr = tipc_own_addr(net); |   write_unlock_bh(&mon->lock);          |   ...             ---truncated---
 漏洞公开时间：2025-05-08 15:15:53
 漏洞创建时间：2025-05-08 15:57:11
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-37824
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/0ceef62a328ce1288598c9242576292671f21e96 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4d5e1e2d3e9d70beff7beab44fd6ce91405a405e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/5fd464fd24de93d0eca377554bf0ff2548f76f30 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a3df56010403b2cd26388096ebccf959d23c4dcc |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d63527e109e811ef11abb1c2985048fdb528b4cb |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/dd6cb0a8575b00fbd503e96903184125176f4fa3 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e6613b6d41f4010c4d484cbc7bfca690d8d522a2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/e79e8e05aa46f90d21023f0ffe6f136ed6a20932 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-37824 | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-37824 | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| suse_bugzilla | https://git.kernel.org/stable/c/0ceef62a328ce1288598c9242576292671f21e96 | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| suse_bugzilla | https://git.kernel.org/stable/c/4d5e1e2d3e9d70beff7beab44fd6ce91405a405e | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| suse_bugzilla | https://git.kernel.org/stable/c/5fd464fd24de93d0eca377554bf0ff2548f76f30 | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| suse_bugzilla | https://git.kernel.org/stable/c/a3df56010403b2cd26388096ebccf959d23c4dcc | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| suse_bugzilla | https://git.kernel.org/stable/c/d63527e109e811ef11abb1c2985048fdb528b4cb | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| suse_bugzilla | https://git.kernel.org/stable/c/dd6cb0a8575b00fbd503e96903184125176f4fa3 | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| suse_bugzilla | https://git.kernel.org/stable/c/e6613b6d41f4010c4d484cbc7bfca690d8d522a2 | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| suse_bugzilla | https://git.kernel.org/stable/c/e79e8e05aa46f90d21023f0ffe6f136ed6a20932 | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-37824.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1242867 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025050821-CVE-2025-37824-61fa@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2365005 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-37824 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 5.4.293 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a3df56010403b2cd26388096ebccf959d23c4dcc | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=28845c28f842e9e55e75b2c116bff714bb039055 | linuxkernelcves |
| linux_kernel | 5.10.237 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e6613b6d41f4010c4d484cbc7bfca690d8d522a2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=28845c28f842e9e55e75b2c116bff714bb039055 | linuxkernelcves |
| linux_kernel | 5.15.181 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5fd464fd24de93d0eca377554bf0ff2548f76f30 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=28845c28f842e9e55e75b2c116bff714bb039055 | linuxkernelcves |
| linux_kernel | 6.1.136 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e79e8e05aa46f90d21023f0ffe6f136ed6a20932 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=28845c28f842e9e55e75b2c116bff714bb039055 | linuxkernelcves |
| linux_kernel | 6.6.89 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=dd6cb0a8575b00fbd503e96903184125176f4fa3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=28845c28f842e9e55e75b2c116bff714bb039055 | linuxkernelcves |
| linux_kernel | 6.12.26 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0ceef62a328ce1288598c9242576292671f21e96 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=28845c28f842e9e55e75b2c116bff714bb039055 | linuxkernelcves |
| linux_kernel | 6.14.5 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4d5e1e2d3e9d70beff7beab44fd6ce91405a405e | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=28845c28f842e9e55e75b2c116bff714bb039055 | linuxkernelcves |
| linux_kernel | 6.15-rc4 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d63527e109e811ef11abb1c2985048fdb528b4cb | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=28845c28f842e9e55e75b2c116bff714bb039055 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:tipc: fix NULL pointer dereference in tipc_mon_reinit_self()syzbot reported:tipc: Node number set to 1055423674Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 3 UID: 0 PID: 6017 Comm: kworker/3:5 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(full)Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014Workqueue: events tipc_net_finalize_workRIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719...RSP: 0018:ffffc9000356fb68 EFLAGS: 00010246RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cbaRDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007R13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010FS:  0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: &lt;TASK&gt; tipc_net_finalize+0x10b/0x180 net/tipc/net.c:140 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 &lt;/TASK&gt;...RIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719...RSP: 0018:ffffc9000356fb68 EFLAGS: 00010246RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cbaRDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007R13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010FS:  0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400There is a racing condition between workqueue created when enablingbearer and another thread created when disabling bearer right afterthat as follow:enabling_bearer                          | disabling_bearer---------------                          | ----------------tipc_disc_timeout()                      |{                                        | bearer_disable() ...                                     | { schedule_work(&#38;tn-&gt;work);               |  tipc_mon_delete() ...                                     |  {}                                        |   ...                                         |   write_lock_bh(&#38;mon-&gt;lock);                                         |   mon-&gt;self = NULL;                                         |   write_unlock_bh(&#38;mon-&gt;lock);                                         |   ...                                         |  }tipc_net_finalize_work()                 | }{                                        | ...                                     | tipc_net_finalize()                     | {                                       |  ...                                    |  tipc_mon_reinit_self()                 |  {                                      |   ...                                   |   write_lock_bh(&#38;mon-&gt;lock);            |   mon-&gt;self-&gt;addr = tipc_own_addr(net); |   write_unlock_bh(&#38;mon-&gt;lock);          |   ...                                   |  }                                      |  ...                                    | }                            
 openEuler评分：
  4.7
 Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP2(6.6.0):受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
5.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
6.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1880

src-openEuler/kernel

内容风险标识

评论 (7)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-37824

评论 (7)

搜索帮助

src-openEuler/kernel