CVE-2025-39885

一、漏洞信息
 漏洞编号：[CVE-2025-39885](https://nvd.nist.gov/vuln/detail/CVE-2025-39885)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:ocfs2: fix recursive semaphore deadlock in fiemap callsyzbot detected a OCFS2 hang due to a recursive semaphore on aFS_IOC_FIEMAP of the extent list on a specially crafted mmap file.context_switch kernel/sched/core.c:5357 [inline]   __schedule+0x1798/0x4cc0 kernel/sched/core.c:6961   __schedule_loop kernel/sched/core.c:7043 [inline]   schedule+0x165/0x360 kernel/sched/core.c:7058   schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7115   rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185   __down_write_common kernel/locking/rwsem.c:1317 [inline]   __down_write kernel/locking/rwsem.c:1326 [inline]   down_write+0x1ab/0x1f0 kernel/locking/rwsem.c:1591   ocfs2_page_mkwrite+0x2ff/0xc40 fs/ocfs2/mmap.c:142   do_page_mkwrite+0x14d/0x310 mm/memory.c:3361   wp_page_shared mm/memory.c:3762 [inline]   do_wp_page+0x268d/0x5800 mm/memory.c:3981   handle_pte_fault mm/memory.c:6068 [inline]   __handle_mm_fault+0x1033/0x5440 mm/memory.c:6195   handle_mm_fault+0x40a/0x8e0 mm/memory.c:6364   do_user_addr_fault+0x764/0x1390 arch/x86/mm/fault.c:1387   handle_page_fault arch/x86/mm/fault.c:1476 [inline]   exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532   asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623RIP: 0010:copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]RIP: 0010:raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]RIP: 0010:_inline_copy_to_user include/linux/uaccess.h:197 [inline]RIP: 0010:_copy_to_user+0x85/0xb0 lib/usercopy.c:26Code: e8 00 bc f7 fc 4d 39 fc 72 3d 4d 39 ec 77 38 e8 91 b9 f7 fc 4c 89f7 89 de e8 47 25 5b fd 0f 01 cb 4c 89 ff 48 89 d9 4c 89 f6 <f3> a4 0f1f 00 48 89 cb 0f 01 ca 48 89 d8 5b 41 5c 41 5d 41 5e 41RSP: 0018:ffffc9000403f950 EFLAGS: 00050256RAX: ffffffff84c7f101 RBX: 0000000000000038 RCX: 0000000000000038RDX: 0000000000000000 RSI: ffffc9000403f9e0 RDI: 0000200000000060RBP: ffffc9000403fa90 R08: ffffc9000403fa17 R09: 1ffff92000807f42R10: dffffc0000000000 R11: fffff52000807f43 R12: 0000200000000098R13: 00007ffffffff000 R14: ffffc9000403f9e0 R15: 0000200000000060   copy_to_user include/linux/uaccess.h:225 [inline]   fiemap_fill_next_extent+0x1c0/0x390 fs/ioctl.c:145   ocfs2_fiemap+0x888/0xc90 fs/ocfs2/extent_map.c:806   ioctl_fiemap fs/ioctl.c:220 [inline]   do_vfs_ioctl+0x1173/0x1430 fs/ioctl.c:532   __do_sys_ioctl fs/ioctl.c:596 [inline]   __se_sys_ioctl+0x82/0x170 fs/ioctl.c:584   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]   do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94   entry_SYSCALL_64_after_hwframe+0x77/0x7fRIP: 0033:0x7f5f13850fd9RSP: 002b:00007ffe3b3518b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f5f13850fd9RDX: 0000200000000040 RSI: 00000000c020660b RDI: 0000000000000004RBP: 6165627472616568 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe3b3518f0R13: 00007ffe3b351b18 R14: 431bde82d7b634db R15: 00007f5f1389a03bocfs2_fiemap() takes a read lock of the ip_alloc_sem semaphore (sincev2.6.22-527-g7307de80510a) and calls fiemap_fill_next_extent() to read theextent list of this running mmap executable.  The user supplied buffer tohold the fiemap information page faults calling ocfs2_page_mkwrite() whichwill take a write lock (since v2.6.27-38-g00dc417fa3e7) of the samesemaphore.  This recursive semaphore will hold filesystem locks and causesa hang of the fileystem.The ip_alloc_sem protects the inode extent list and size.  Release theread semphore before calling fiemap_fill_next_extent() in ocfs2_fiemap()and ocfs2_fiemap_inline().  This does an unnecessary semaphore lock/unlockon the last extent but simplifies the error path.
 漏洞公开时间：2025-09-23 14:15:48
 漏洞创建时间：2025-09-23 14:35:59
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-39885
<details>
<summary>更多参考(点击展开)</summary>

无
</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/0709bc11b942870fc0a7be150e42aea42321093a |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/1d3c96547ee2ddeaddf8f19a3ef99ea06cc8115e |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/9efcb7a8b97310efed995397941a292cf89fa94f |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/04100f775c2ea501927f508f17ad824ad1f23c8d |  | ljqc |

</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
                             
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

原因说明：
  1.master(6.12.33):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP3(5.10.0):
4.openEuler-22.03-LTS-SP4(5.10.0):
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next:
7.openEuler-24.03-LTS-SP1:
8.openEuler-24.03-LTS-SP2:

src-openEuler/kernel

内容风险标识

评论 (3)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-39885

评论 (3)

搜索帮助

src-openEuler/kernel