CVE-2025-38455

一、漏洞信息
 漏洞编号：[CVE-2025-38455](https://nvd.nist.gov/vuln/detail/CVE-2025-38455)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flightReject migration of SEV{-ES} state if either the source or destination VMis actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in thesection between incrementing created_vcpus and online_vcpus.  The bulk ofvCPU creation runs _outside_ of kvm->lock to allow creating multiple vCPUsin parallel, and so sev_info.es_active can get toggled from false=>true inthe destination VM after (or during) svm_vcpu_create(), resulting in anSEV{-ES} VM effectively having a non-SEV{-ES} vCPU.The issue manifests most visibly as a crash when trying to free a vCPU sNULL VMSA page in an SEV-ES VM, but any number of things can go wrong.  BUG: unable to handle page fault for address: ffffebde00000000  #PF: supervisor read access in kernel mode  #PF: error_code(0x0000) - not-present page  PGD 0 P4D 0  Oops: Oops: 0000 [#1] SMP KASAN NOPTI  CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G     U     O        6.15.0-smp-DEV #2 NONE  Tainted: [U]=USER, [O]=OOT_MODULE  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024  RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline]  RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline]  RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]  RIP: 0010:PageHead include/linux/page-flags.h:866 [inline]  RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067  Code: <49> f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0  RSP: 0018:ffff8984551978d0 EFLAGS: 00010246  RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98  RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000  RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000  R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000  R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000  FS:  0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0  DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400  Call Trace:   <TASK>   sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169   svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515   kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396   kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline]   kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490   kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895   kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310   kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369   __fput+0x3e4/0x9e0 fs/file_table.c:465   task_work_run+0x1a9/0x220 kernel/task_work.c:227   exit_task_work include/linux/task_work.h:40 [inline]   do_exit+0x7f0/0x25b0 kernel/exit.c:953   do_group_exit+0x203/0x2d0 kernel/exit.c:1102   get_signal+0x1357/0x1480 kernel/signal.c:3034   arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337   exit_to_user_mode_loop kernel/entry/common.c:111 [inline]   exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]   __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]   syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218   do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100   entry_SYSCALL_64_after_hwframe+0x76/0x7e  RIP: 0033:0x7f87a898e969   </TASK>  Modules linked in: gq(O)  gsmi: Log Shutdown Reason 0x03  CR2: ffffebde00000000  ---[ end trace 0000000000000000 ]---Deliberately don t check for a NULL VMSA when freeing the vCPU, as crashingthe host is likely desirable due to the VMSA being consumed by hardware.E.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write abogus VMSA page.  Accessing P---truncated---
 漏洞公开时间：2025-07-26 00:15:31
 漏洞创建时间：2025-07-26 00:27:23
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-38455
<details>
<summary>更多参考(点击展开)</summary>

无
</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01 |  | ljqc |

</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
                                         
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

原因说明：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

src-openEuler / kernel
Closed

Content Risk Flag

Comments (3)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-38455

Comments (3)

Search

src-openEuler / kernel
Closed