CVE-2025-38279

一、漏洞信息
 漏洞编号：[CVE-2025-38279](https://nvd.nist.gov/vuln/detail/CVE-2025-38279)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:bpf: Do not include stack ptr register in precision backtracking bookkeepingYi Lai reported an issue ([1]) where the following warning appearsin kernel dmesg:  [   60.643604] verifier backtracking bug  [   60.643635] WARNING: CPU: 10 PID: 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10  [   60.648428] Modules linked in: bpf_testmod(OE)  [   60.650471] CPU: 10 UID: 0 PID: 2315 Comm: test_progs Tainted: G           OE       6.15.0-rc4-gef11287f8289-dirty #327 PREEMPT(full)  [   60.654385] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE  [   60.656682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014  [   60.660475] RIP: 0010:__mark_chain_precision+0x3a6c/0x3e10  [   60.662814] Code: 5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04                       01 48 c7 c7 00 58 30 84 e8 c4 06 a5 ff <0f> 0b e9 46 fa ff ff 48 ...  [   60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246  [   60.671075] RAX: 54d70e82dfd31900 RBX: ffff888115b65e20 RCX: 0000000000000000  [   60.673659] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000ffffffff  [   60.676241] RBP: 0000000000000400 R08: ffff8881f6f23bd3 R09: 1ffff1103ede477a  [   60.678787] R10: dffffc0000000000 R11: ffffed103ede477b R12: ffff888115b60ae8  [   60.681420] R13: 1ffff11022b6cbc4 R14: 00000000fffffff2 R15: 0000000000000001  [   60.684030] FS:  00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000  [   60.686837] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  [   60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0  [   60.691623] Call Trace:  [   60.692821]  <TASK>  [   60.693960]  ? __pfx_verbose+0x10/0x10  [   60.695656]  ? __pfx_disasm_kfunc_name+0x10/0x10  [   60.697495]  check_cond_jmp_op+0x16f7/0x39b0  [   60.699237]  do_check+0x58fa/0xab10  ...Further analysis shows the warning is at line 4302 as below:  4294                 /* static subprog call instruction, which  4295                  * means that we are exiting current subprog,  4296                  * so only r1-r5 could be still requested as  4297                  * precise, r0 and r6-r10 or any stack slot in  4298                  * the current frame should be zero by now  4299                  */  4300                 if (bt_reg_mask(bt) & ~BPF_REGMASK_ARGS) {  4301                         verbose(env,  BUG regs %x n , bt_reg_mask(bt));  4302                         WARN_ONCE(1,  verifier backtracking bug );  4303                         return -EFAULT;  4304                 }With the below test (also in the next patch):  __used __naked static void __bpf_jmp_r10(void)  {	asm volatile (	 r2 = 2314885393468386424 ll; 	 goto +0; 	 if r2 <= r10 goto +3; 	 if r1 >= -1835016 goto +0; 	 if r2 <= 8 goto +0; 	 if r3 <= 0 goto +0; 	 exit; 	::: __clobber_all);  }  SEC( ?raw_tp )  __naked void bpf_jmp_r10(void)  {	asm volatile (	 r3 = 0 ll; 	 call __bpf_jmp_r10; 	 r0 = 0; 	 exit; 	::: __clobber_all);  }The following is the verifier failure log:  0: (18) r3 = 0x0                      ; R3_w=0  2: (85) call pc+2  caller:   R10=fp0  callee:   frame1: R1=ctx() R3_w=0 R10=fp0  5: frame1: R1=ctx() R3_w=0 R10=fp0  ; asm volatile (                                    @ verifier_precision.c:184  5: (18) r2 = 0x20202000256c6c78       ; frame1: R2_w=0x20202000256c6c78  7: (05) goto pc+0  8: (bd) if r2 <= r10 goto pc+3        ; frame1: R2_w=0x20202000256c6c78 R10=fp0  9: (35) if r1 >= 0xffe3fff8 goto pc+0         ; frame1: R1=ctx()  10: (b5) if r2 <= 0x8 goto pc+0  mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1  mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto pc+0  mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 goto pc+3  mark_preci---truncated---
 漏洞公开时间：2025-07-10 16:15:26
 漏洞创建时间：2025-07-10 17:42:48
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-38279
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://git.kernel.org/stable/c/ac49b7560b4b08b1e4043a29214cc7ad77644c00 |  |
|  | https://git.kernel.org/stable/c/e2d2115e56c4a02377189bfc3a9a7933552a7b0f |  |
|  | https://security-tracker.debian.org/tracker/CVE-2025-38279 |  |
|  | https://git.kernel.org/stable/c/4265682c29c92f52c0da6fad5a79b5801462c8de |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38279 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://github.com/gregkh/linux/commit/4265682c29c92f52c0da6fad5a79b5801462c8de.patch |  | ljqc |
|  |  | https://git.kernel.org/stable/c/ac49b7560b4b08b1e4043a29214cc7ad77644c00 |  | nvd |
|  |  | https://git.kernel.org/stable/c/e2d2115e56c4a02377189bfc3a9a7933552a7b0f |  | nvd |
|  |  | https://git.kernel.org/stable/c/4265682c29c92f52c0da6fad5a79b5801462c8de |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:bpf: Do not include stack ptr register in precision backtracking bookkeepingYi Lai reported an issue ([1]) where the following warning appearsin kernel dmesg:  [   60.643604] verifier backtracking bug  [   60.643635] WARNING: CPU: 10 PID: 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10  [   60.648428] Modules linked in: bpf_testmod(OE)  [   60.650471] CPU: 10 UID: 0 PID: 2315 Comm: test_progs Tainted: G           OE       6.15.0-rc4-gef11287f8289-dirty #327 PREEMPT(full)  [   60.654385] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE  [   60.656682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014  [   60.660475] RIP: 0010:__mark_chain_precision+0x3a6c/0x3e10  [   60.662814] Code: 5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04                       01 48 c7 c7 00 58 30 84 e8 c4 06 a5 ff &lt;0f&gt; 0b e9 46 fa ff ff 48 ...  [   60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246  [   60.671075] RAX: 54d70e82dfd31900 RBX: ffff888115b65e20 RCX: 0000000000000000  [   60.673659] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000ffffffff  [   60.676241] RBP: 0000000000000400 R08: ffff8881f6f23bd3 R09: 1ffff1103ede477a  [   60.678787] R10: dffffc0000000000 R11: ffffed103ede477b R12: ffff888115b60ae8  [   60.681420] R13: 1ffff11022b6cbc4 R14: 00000000fffffff2 R15: 0000000000000001  [   60.684030] FS:  00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000  [   60.686837] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  [   60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0  [   60.691623] Call Trace:  [   60.692821]  &lt;TASK&gt;  [   60.693960]  ? __pfx_verbose+0x10/0x10  [   60.695656]  ? __pfx_disasm_kfunc_name+0x10/0x10  [   60.697495]  check_cond_jmp_op+0x16f7/0x39b0  [   60.699237]  do_check+0x58fa/0xab10  ...Further analysis shows the warning is at line 4302 as below:  4294                 /* static subprog call instruction, which  4295                  * means that we are exiting current subprog,  4296                  * so only r1-r5 could be still requested as  4297                  * precise, r0 and r6-r10 or any stack slot in  4298                  * the current frame should be zero by now  4299                  */  4300                 if (bt_reg_mask(bt) &#38; ~BPF_REGMASK_ARGS) {  4301                         verbose(env, &#34;BUG regs %x n&#34;, bt_reg_mask(bt));  4302                         WARN_ONCE(1, &#34;verifier backtracking bug&#34;);  4303                         return -EFAULT;  4304                 }With the below test (also in the next patch):  __used __naked static void __bpf_jmp_r10(void)  {asm volatile (&#34;r2 = 2314885393468386424 ll;&#34;&#34;goto +0;&#34;&#34;if r2 &lt;= r10 goto +3;&#34;&#34;if r1 &gt;= -1835016 goto +0;&#34;&#34;if r2 &lt;= 8 goto +0;&#34;&#34;if r3 &lt;= 0 goto +0;&#34;&#34;exit;&#34;::: __clobber_all);  }  SEC(&#34;?raw_tp&#34;)  __naked void bpf_jmp_r10(void)  {asm volatile (&#34;r3 = 0 ll;&#34;&#34;call __bpf_jmp_r10;&#34;&#34;r0 = 0;&#34;&#34;exit;&#34;::: __clobber_all);  }The following is the verifier failure log:  0: (18) r3 = 0x0                      ; R3_w=0  2: (85) call pc+2  caller:   R10=fp0  callee:   frame1: R1=ctx() R3_w=0 R10=fp0  5: frame1: R1=ctx() R3_w=0 R10=fp0  ; asm volatile (&#34;                                   @ verifier_precision.c:184  5: (18) r2 = 0x20202000256c6c78       ; frame1: R2_w=0x20202000256c6c78  7: (05) goto pc+0  8: (bd) if r2 &lt;= r10 goto pc+3        ; frame1: R2_w=0x20202000256c6c78 R10=fp0  9: (35) if r1 &gt;= 0xffe3fff8 goto pc+0         ; frame1: R1=ctx()  10: (b5) if r2 &lt;= 0x8 goto pc+0  mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1  mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 &gt;= 0xffe3fff8 goto pc+0  mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 &lt;= r10 goto pc+3  mark_precise: frame1: regs=r2,r10 stack= before 7: (05) goto pc+0  m
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-24.03-LTS-SP1(6.6.0):受影响
3.openEuler-24.03-LTS-SP2(6.6.0):受影响
4.master(6.12.33):不受影响
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响
6.openEuler-22.03-LTS-SP3(5.10.0):不受影响
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

src-openEuler/kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-38279

Comments (7)

Search

src-openEuler/kernel
Closed