CVE-2025-39704

一、漏洞信息
 漏洞编号：[CVE-2025-39704](https://nvd.nist.gov/vuln/detail/CVE-2025-39704)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:LoongArch: KVM: Fix stack protector issue in send_ipi_data()Function kvm_io_bus_read() is called in function send_ipi_data(), buffersize of parameter *val should be at least 8 bytes. Since some emulationfunctions like loongarch_ipi_readl() and kvm_eiointc_read() will writethe buffer *val with 8 bytes signed extension regardless parameter len.Otherwise there will be buffer overflow issue when CONFIG_STACKPROTECTORis enabled. The bug report is shown as follows:Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: send_ipi_data+0x194/0x1a0 [kvm]CPU: 11 UID: 107 PID: 2692 Comm: CPU 0/KVM Not tainted 6.17.0-rc1+ #102 PREEMPT(full)Stack : 9000000005901568 0000000000000000 9000000003af371c 900000013c68c000        900000013c68f850 900000013c68f858 0000000000000000 900000013c68f998        900000013c68f990 900000013c68f990 900000013c68f6c0 fffffffffffdb058        fffffffffffdb0e0 900000013c68f858 911e1d4d39cf0ec2 9000000105657a00        0000000000000001 fffffffffffffffe 0000000000000578 282049464555206e        6f73676e6f6f4c20 0000000000000001 00000000086b4000 0000000000000000        0000000000000000 0000000000000000 9000000005709968 90000000058f9000        900000013c68fa68 900000013c68fab4 90000000029279f0 900000010153f940        900000010001f360 0000000000000000 9000000003af3734 000000004390000c        00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d        ...Call Trace:[<9000000003af3734>] show_stack+0x5c/0x180[<9000000003aed168>] dump_stack_lvl+0x6c/0x9c[<9000000003ad0ab0>] vpanic+0x108/0x2c4[<9000000003ad0ca8>] panic+0x3c/0x40[<9000000004eb0a1c>] __stack_chk_fail+0x14/0x18[<ffff8000023473f8>] send_ipi_data+0x190/0x1a0 [kvm][<ffff8000023313e4>] __kvm_io_bus_write+0xa4/0xe8 [kvm][<ffff80000233147c>] kvm_io_bus_write+0x54/0x90 [kvm][<ffff80000233f9f8>] kvm_emu_iocsr+0x180/0x310 [kvm][<ffff80000233fe08>] kvm_handle_gspr+0x280/0x478 [kvm][<ffff8000023443e8>] kvm_handle_exit+0xc0/0x130 [kvm]
 漏洞公开时间：2025-09-06 02:15:47
 漏洞创建时间：2025-09-06 02:01:55
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-39704
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://lore.kernel.org/linux-cve-announce/2025090549-CVE-2025-39704-f9b5@gregkh/T/#u |  |
|  | https://git.kernel.org/stable/c/b5b49d341f90eed6de794b6ff34ad3dd66d34343 |  |
|  | https://git.kernel.org/stable/c/5c68549c81bcca70fc464e305ffeefd9af968287 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-39704 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39704 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025090549-CVE-2025-39704-f9b5@gregkh/T |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2393521 |  |
|  | https://ubuntu.com/security/CVE-2025-39704 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-39704 |  |
|  | https://git.kernel.org/linus/5c68549c81bcca70fc464e305ffeefd9af968287 |  |
|  | https://git.kernel.org/stable/c/5c68549c81bcca70fc464e305ffeefd9af968287 |  |
|  | https://git.kernel.org/stable/c/b5b49d341f90eed6de794b6ff34ad3dd66d34343 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://github.com/gregkh/linux/commit/b5b49d341f90eed6de794b6ff34ad3dd66d34343.patch |  | ljqc |
|  |  | https://git.kernel.org/stable/c/b5b49d341f90eed6de794b6ff34ad3dd66d34343 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/5c68549c81bcca70fc464e305ffeefd9af968287 |  | cvelistv5 |
|  |  | https://git.kernel.org/linus/5c68549c81bcca70fc464e305ffeefd9af968287 |  | osv |
|  |  | https://git.kernel.org/stable/c/5c68549c81bcca70fc464e305ffeefd9af968287 |  | osv |
|  |  | https://git.kernel.org/stable/c/b5b49d341f90eed6de794b6ff34ad3dd66d34343 |  | osv |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:LoongArch: KVM: Fix stack protector issue in send_ipi_data()Function kvm_io_bus_read() is called in function send_ipi_data(), buffersize of parameter *val should be at least 8 bytes. Since some emulationfunctions like loongarch_ipi_readl() and kvm_eiointc_read() will writethe buffer *val with 8 bytes signed extension regardless parameter len.Otherwise there will be buffer overflow issue when CONFIG_STACKPROTECTORis enabled. The bug report is shown as follows:Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: send_ipi_data+0x194/0x1a0 [kvm]CPU: 11 UID: 107 PID: 2692 Comm: CPU 0/KVM Not tainted 6.17.0-rc1+ #102 PREEMPT(full)Stack : 9000000005901568 0000000000000000 9000000003af371c 900000013c68c000        900000013c68f850 900000013c68f858 0000000000000000 900000013c68f998        900000013c68f990 900000013c68f990 900000013c68f6c0 fffffffffffdb058        fffffffffffdb0e0 900000013c68f858 911e1d4d39cf0ec2 9000000105657a00        0000000000000001 fffffffffffffffe 0000000000000578 282049464555206e        6f73676e6f6f4c20 0000000000000001 00000000086b4000 0000000000000000        0000000000000000 0000000000000000 9000000005709968 90000000058f9000        900000013c68fa68 900000013c68fab4 90000000029279f0 900000010153f940        900000010001f360 0000000000000000 9000000003af3734 000000004390000c        00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d        ...Call Trace:[&lt;9000000003af3734&gt;] show_stack+0x5c/0x180[&lt;9000000003aed168&gt;] dump_stack_lvl+0x6c/0x9c[&lt;9000000003ad0ab0&gt;] vpanic+0x108/0x2c4[&lt;9000000003ad0ca8&gt;] panic+0x3c/0x40[&lt;9000000004eb0a1c&gt;] __stack_chk_fail+0x14/0x18[&lt;ffff8000023473f8&gt;] send_ipi_data+0x190/0x1a0 [kvm][&lt;ffff8000023313e4&gt;] __kvm_io_bus_write+0xa4/0xe8 [kvm][&lt;ffff80000233147c&gt;] kvm_io_bus_write+0x54/0x90 [kvm][&lt;ffff80000233f9f8&gt;] kvm_emu_iocsr+0x180/0x310 [kvm][&lt;ffff80000233fe08&gt;] kvm_handle_gspr+0x280/0x478 [kvm][&lt;ffff8000023443e8&gt;] kvm_handle_exit+0xc0/0x130 [kvm]The Linux kernel CVE team has assigned CVE-2025-39704 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:不受影响
8.openEuler-24.03-LTS-SP2:不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
  1.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
2.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
3.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS:不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (5)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-39704

Comments (5)

Search

src-openEuler / kernel
Closed