CVE-2025-38400

一、漏洞信息
 漏洞编号：[CVE-2025-38400](https://nvd.nist.gov/vuln/detail/CVE-2025-38400)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.syzbot reported a warning below [1] following a fault injection innfs_fs_proc_net_init(). [0]When nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed.Later, rpc_proc_exit() tries to remove /proc/net/rpc, and the warningis logged as the directory is not empty.Let s handle the error of nfs_fs_proc_net_init() properly.[0]:FAULT_INJECTION: forcing a failure.name failslab, interval 1, probability 0, space 0, times 0CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025Call Trace: <TASK>  dump_stack_lvl (lib/dump_stack.c:123) should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174) should_failslab (mm/failslab.c:46) kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204) __proc_create (fs/proc/generic.c:427) proc_create_reg (fs/proc/generic.c:554) proc_create_net_data (fs/proc/proc_net.c:120) nfs_fs_proc_net_init (fs/nfs/client.c:1409) nfs_net_init (fs/nfs/inode.c:2600) ops_init (net/core/net_namespace.c:138) setup_net (net/core/net_namespace.c:443) copy_net_ns (net/core/net_namespace.c:576) create_new_namespaces (kernel/nsproxy.c:110) unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4)) ksys_unshare (kernel/fork.c:3123) __x64_sys_unshare (kernel/fork.c:3190) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK>[1]:remove_proc_entry: removing non-empty directory  net/rpc , leaking at least  nfs  WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727Modules linked in:CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727Code: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 <0f> 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00RSP: 0018:ffffc90003637b08 EFLAGS: 00010282RAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8RDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001RBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000R10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00R13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000FS:  0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: <TASK>  sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76  ops_exit_list net/core/net_namespace.c:200 [inline]  ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253  setup_net+0x2e1/0x510 net/core/net_namespace.c:457  copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574  create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110  unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218  ksys_unshare+0x45b/0xa40 kernel/fork.c:3121  __do_sys_unshare kernel/fork.c:3192 [inline]  __se_sys_unshare kernel/fork.c:3190 [inline]  __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]  do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7fRIP: 0033:0x7fa1a6b8e929Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c---truncated---
 漏洞公开时间：2025-07-25 21:15:29
 漏洞创建时间：2025-07-25 22:07:55
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-38400
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://git.kernel.org/stable/c/3c94212b57bedec3a386ef3da1ef00602f5c3d1d |  |
|  | https://git.kernel.org/stable/c/412534a1fb76958b88dca48360c6f3ad4f3390f4 |  |
|  | https://git.kernel.org/stable/c/6acf340f8c1d296bcf535986175f5d0d6f2aab09 |  |
|  | https://git.kernel.org/stable/c/7701c245ff1ac1a126bf431e72b24547519046ff |  |
|  | https://git.kernel.org/stable/c/8785701fd7cd52ae74c0d2b35b82568df74e9dbb |  |
|  | https://git.kernel.org/stable/c/b92397ce96743e4cc090207e2df2a856cb4cef08 |  |
|  | https://git.kernel.org/stable/c/d0877c479f44fe475f4c8c02c88ce9ad43e90298 |  |
|  | https://git.kernel.org/stable/c/e8d6f3ab59468e230f3253efe5cb63efa35289f7 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025072510-CVE-2025-38400-a0d2@gregkh/T/#u |  |
|  | https://security-tracker.debian.org/tracker/CVE-2025-38400 |  |
|  | https://ubuntu.com/security/CVE-2025-38400 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-38400 |  |
|  | https://git.kernel.org/linus/e8d6f3ab59468e230f3253efe5cb63efa35289f7 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-38400 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38400 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025072510-CVE-2025-38400-a0d2@gregkh/T |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2383397 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://github.com/gregkh/linux/commit/e8d6f3ab59468e230f3253efe5cb63efa35289f7.patch |  | ljqc |
|  |  | https://git.kernel.org/stable/c/3c94212b57bedec3a386ef3da1ef00602f5c3d1d |  | nvd |
|  |  | https://git.kernel.org/stable/c/412534a1fb76958b88dca48360c6f3ad4f3390f4 |  | nvd |
|  |  | https://git.kernel.org/stable/c/6acf340f8c1d296bcf535986175f5d0d6f2aab09 |  | nvd |
|  |  | https://git.kernel.org/stable/c/7701c245ff1ac1a126bf431e72b24547519046ff |  | nvd |
|  |  | https://git.kernel.org/stable/c/8785701fd7cd52ae74c0d2b35b82568df74e9dbb |  | nvd |
|  |  | https://git.kernel.org/stable/c/b92397ce96743e4cc090207e2df2a856cb4cef08 |  | nvd |
|  |  | https://git.kernel.org/stable/c/d0877c479f44fe475f4c8c02c88ce9ad43e90298 |  | nvd |
|  |  | https://git.kernel.org/stable/c/e8d6f3ab59468e230f3253efe5cb63efa35289f7 |  | nvd |
|  |  | https://git.kernel.org/linus/e8d6f3ab59468e230f3253efe5cb63efa35289f7 |  | osv |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.syzbot reported a warning below [1] following a fault injection innfs_fs_proc_net_init(). [0]When nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed.Later, rpc_proc_exit() tries to remove /proc/net/rpc, and the warningis logged as the directory is not empty.Let&#39;s handle the error of nfs_fs_proc_net_init() properly.[0]:FAULT_INJECTION: forcing a failure.name failslab, interval 1, probability 0, space 0, times 0CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025Call Trace: &lt;TASK&gt;  dump_stack_lvl (lib/dump_stack.c:123) should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174) should_failslab (mm/failslab.c:46) kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204) __proc_create (fs/proc/generic.c:427) proc_create_reg (fs/proc/generic.c:554) proc_create_net_data (fs/proc/proc_net.c:120) nfs_fs_proc_net_init (fs/nfs/client.c:1409) nfs_net_init (fs/nfs/inode.c:2600) ops_init (net/core/net_namespace.c:138) setup_net (net/core/net_namespace.c:443) copy_net_ns (net/core/net_namespace.c:576) create_new_namespaces (kernel/nsproxy.c:110) unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4)) ksys_unshare (kernel/fork.c:3123) __x64_sys_unshare (kernel/fork.c:3190) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) &lt;/TASK&gt;[1]:remove_proc_entry: removing non-empty directory &#39;net/rpc&#39;, leaking at least &#39;nfs&#39; WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727Modules linked in:CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727Code: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 &lt;0f&gt; 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00RSP: 0018:ffffc90003637b08 EFLAGS: 00010282RAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8RDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001RBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000R10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00R13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000FS:  0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: &lt;TASK&gt;  sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76  ops_exit_list net/core/net_namespace.c:200 [inline]  ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253  setup_net+0x2e1/0x510 net/core/net_namespace.c:457  copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574  create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110  unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218  ksys_unshare+0x45b/0xa40 kernel/fork.c:3121  __do_sys_unshare kernel/fork.c:3192 [inline]  __se_sys_unshare kernel/fork.c:3190 [inline]  __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]  do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7fRIP: 0033:0x7fa1a6b8e929Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 &lt;48&gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007fff3a090368 EFLAGS: 00000246 ORIG_RAX: 0000000000000110RAX: ffffffffffffffda RBX: 0000
 openEuler评分：
  3.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-24.03-LTS-SP1(6.6.0):受影响
5.openEuler-24.03-LTS-SP2(6.6.0):受影响
6.master(6.12.33):不受影响
7.openEuler-20.03-LTS-SP4(4.19.90):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-22.03-LTS-SP3(5.10.0):正常修复
2.openEuler-22.03-LTS-SP4(5.10.0):正常修复
3.openEuler-24.03-LTS(6.6.0):正常修复
4.openEuler-24.03-LTS-SP1(6.6.0):正常修复
5.openEuler-24.03-LTS-SP2(6.6.0):正常修复
6.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-38400

Comments (7)

Search

src-openEuler / kernel
Closed