CVE-2025-37835

一、漏洞信息
 漏洞编号：[CVE-2025-37835](https://nvd.nist.gov/vuln/detail/CVE-2025-37835)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:smb: client: Fix netns refcount imbalance causing leaks and use-after-freeCommit ef7134c7fc48 ( smb: client: Fix use-after-free of networknamespace. ) attempted to fix a netns use-after-free issue by manuallyadjusting reference counts via sk->sk_net_refcnt and sock_inuse_add().However, a later commit e9f2517a3e18 ( smb: client: fix TCP timers deadlockafter rmmod ) pointed out that the approach of manually settingsk->sk_net_refcnt in the first commit was technically incorrect, assk->sk_net_refcnt should only be set for user sockets. It led to issueslike TCP timers not being cleared properly on close. The second commitmoved to a model of just holding an extra netns reference forserver->ssocket using get_net(), and dropping it when the server is torndown.But there remain some gaps in the get_net()/put_net() balancing added bythese commits. The incomplete reference handling in these fixes resultsin two issues:1. Netns refcount leaks[1]The problem process is as follows:```mount.cifs                        cifsdcifs_do_mount  cifs_mount    cifs_mount_get_session      cifs_get_tcp_session        get_net()  /* First get net. */        ip_connect          generic_ip_connect /* Try port 445 */            get_net()            ->connect() /* Failed */            put_net()          generic_ip_connect /* Try port 139 */            get_net() /* Missing matching put_net() for this get_net().*/      cifs_get_smb_ses        cifs_negotiate_protocol          smb2_negotiate            SMB2_negotiate              cifs_send_recv                wait_for_response                                 cifs_demultiplex_thread                                   cifs_read_from_socket                                     cifs_readv_from_socket                                       cifs_reconnect                                         cifs_abort_connection                                           sock_release();                                           server->ssocket = NULL;                                           /* Missing put_net() here. */                                           generic_ip_connect                                             get_net()                                             ->connect() /* Failed */                                             put_net()                                             sock_release();                                             server->ssocket = NULL;          free_rsp_buf    ...                                   clean_demultiplex_info                                     /* It s only called once here. */                                     put_net()```When cifs_reconnect() is triggered, the server->ssocket is releasedwithout a corresponding put_net() for the reference acquired ingeneric_ip_connect() before. it ends up calling generic_ip_connect()again to retry get_net(). After that, server->ssocket is set to NULLin the error path of generic_ip_connect(), and the net count cannot bereleased in the final clean_demultiplex_info() function.2. Potential use-after-freeThe current refcounting scheme can lead to a potential use-after-free issuein the following scenario:``` cifs_do_mount   cifs_mount     cifs_mount_get_session       cifs_get_tcp_session         get_net()  /* First get net */           ip_connect             generic_ip_connect               get_net()               bind_socket	         kernel_bind /* failed */               put_net()         /* after out_err_crypto_release label */         put_net()         /* after out_err label */         put_net()```In the exception handling process where binding the socket fails, theget_net() and put_net() calls are unbalanced, which may cause theserver->net reference count to drop to zero and be prematurely released.To address both issues, this patch ties the netns reference counti---truncated---
 漏洞公开时间：2025-05-09 15:16:04
 漏洞创建时间：2025-05-09 16:04:39
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-37835
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/476617a4ca0123f0df677d547a82a110c27c8c74 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4e7f1644f2ac6d01dc584f6301c3b1d5aac4eaef |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7d8dfc27d90d41627c0d6ada97ed0ab57b3dae25 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/961755d0055e0e96d1849cc0425da966c8a64e53 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c6b6b8dcef4adf8ee4e439bb97e74106096c71b8 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
  
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

修复是否涉及abi变化(是/否)：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS(6.6.0):
6.openEuler-24.03-LTS-Next(6.6.0):
7.openEuler-24.03-LTS-SP1(6.6.0):
8.openEuler-24.03-LTS-SP2(6.6.0):

src-openEuler/kernel

内容风险标识

评论 (4)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-37835

评论 (4)

搜索帮助

src-openEuler/kernel