CVE-2025-40048

一、漏洞信息
 漏洞编号：[CVE-2025-40048](https://nvd.nist.gov/vuln/detail/CVE-2025-40048)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V4.0分值：
  BaseScore：N/A None
  Vector：
 漏洞简述：
  In the Linux kernel, a race condition vulnerability exists in the uio_hv_generic driver. The driver s default interrupt mask setting logic is flawed, as the interrupt mask value should be completely controlled by user space. If the mask bit gets changed by the driver concurrently with user mode operating on the ring, the mask bit may be set when it is supposed to be clear, causing the user-mode driver to miss an interrupt and leading to a system hang.Specifically, when the driver sets the inbound ring buffer interrupt mask to 1, the host does not interrupt the guest on the UIO VMBus channel. However, setting the mask does not prevent the host from putting a message in the inbound ring buffer. This results in the host putting a message into the ring buffer without interruption. Subsequently, when user space code in the guest sets the inbound ring buffer interrupt mask to 0 and waits for an interrupt via pread(), since there s already a message in the ring buffer, no new interrupt is generated, causing pread() to wait indefinitely.The fix removes all instances where interrupt_mask is changed, while keeping the one in set_event() unchanged to enable user space control of the interrupt mask by writing 0/1 to /dev/uioX.
 漏洞公开时间：2025-10-28 20:15:38
 漏洞创建时间：2025-10-28 20:42:32
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-40048
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40204 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40200 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38705 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40055 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.115 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.111 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40141 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37828 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39694 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.109 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38011 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40110 |  |
|  | https://git.kernel.org/stable/c/37bd91f22794dc05436130d6983302cb90ecfe7e |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40082 |  |
|  | https://bugs.mageia.org/show_bug.cgi?id=34721 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40134 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40169 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2765 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40179 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40120 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40192 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38729 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40171 |  |
|  | https://linux.oracle.com/cve/CVE-2025-40048.html |  |
|  | https://advisories.mageia.org/MGASA-2025-0309.html |  |
|  | https://git.kernel.org/stable/c/b15b7d2a1b09ef5428a8db260251897405a19496 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40178 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40125 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40129 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40187 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-21915 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40183 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40164 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39703 |  |
|  | https://linux.oracle.com/errata/ELSA-2025-28049.html |  |
|  | https://lore.kernel.org/linux-cve-announce/2025102814-CVE-2025-40048-3bce@gregkh/T/#u |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2406741 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38234 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40035 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40140 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40211 |  |
|  | https://git.kernel.org/stable/c/01ce972e6f9974a7c76943bcb7e93746917db83a |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38349 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.108 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38214 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40048 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40201 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38100 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37839 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.110 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40109 |  |
|  | https://linux.oracle.com/errata/ELSA-2025-28040.html |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.114 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37891 |  |
|  | https://git.kernel.org/stable/c/e29587c07537929684faa365027f4b0d87521e1b |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.106 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.116 |  |
|  | https://linux.oracle.com/errata/ELSA-2025-28048.html |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39964 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37785 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.112 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39931 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-40048 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39940 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40176 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38173 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2766 |  |
|  | https://git.kernel.org/stable/c/65d40acd911c7011745cbbd2aaac34eb5266d11e |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40123 |  |
|  | https://git.kernel.org/stable/c/a44f61f878f32071d6378e8dd7c2d47f9490c8f7 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38084 |  |
|  | https://advisories.mageia.org/MGASA-2025-0310.html |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40088 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39751 |  |
|  | https://security-tracker.debian.org/tracker/CVE-2025-40048 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40084 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38581 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40167 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40194 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40173 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37812 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40190 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-36357 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40198 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025102814-CVE-2025-40048-3bce@gregkh/T |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2767 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39938 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40153 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.113 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40053 |  |
|  | https://bugs.mageia.org/show_bug.cgi?id=34713 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-23150 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22080 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40202 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40048 |  |
|  | https://advisory.echohq.com/cve/CVE-2025-40048 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37863 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40206 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38717 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39692 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/a44f61f878f32071d6378e8dd7c2d47f9490c8f7 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/01ce972e6f9974a7c76943bcb7e93746917db83a |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/2af39ab5e6dc46b835a52e80a22d0cad430985e3 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/37bd91f22794dc05436130d6983302cb90ecfe7e |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/e29587c07537929684faa365027f4b0d87521e1b |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/b15b7d2a1b09ef5428a8db260251897405a19496 |  | ljqc |
|  |  | https://git.kernel.org/stable/c/37bd91f22794dc05436130d6983302cb90ecfe7e |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/b15b7d2a1b09ef5428a8db260251897405a19496 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/01ce972e6f9974a7c76943bcb7e93746917db83a |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/e29587c07537929684faa365027f4b0d87521e1b |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/65d40acd911c7011745cbbd2aaac34eb5266d11e |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/a44f61f878f32071d6378e8dd7c2d47f9490c8f7 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/2af39ab5e6dc46b835a52e80a22d0cad430985e3 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/540aac117eaea5723cef5e4cbf3035c4ac654d92 |  | cvelistv5 |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:uio_hv_generic: Let userspace take care of interrupt maskRemove the logic to set interrupt mask by default in uio_hv_genericdriver as the interrupt mask value is supposed to be controlledcompletely by the user space. If the mask bit gets changedby the driver, concurrently with user mode operating on the ring,the mask bit may be set when it is supposed to be clear, and theuser-mode driver will miss an interrupt which will cause a hang.For eg- when the driver sets inbound ring buffer interrupt mask to 1,the host does not interrupt the guest on the UIO VMBus channel.However, setting the mask does not prevent the host from putting amessage in the inbound ring buffer.&#160;So let&#8217;s assume that happens,the host puts a message into the ring buffer but does not interrupt.Subsequently, the user space code in the guest sets the inbound ringbuffer interrupt mask to 0, saying &#8220;Hey, I&#8217;m ready for interrupts&#8221;.User space code then calls pread() to wait for an interrupt.Then one of two things happens:* The host never sends another message. So the pread() waits forever.* The host does send another message. But because there&#8217;s already a  message in the ring buffer, it doesn&#8217;t generate an interrupt.  This is the correct behavior, because the host should only send an  interrupt when the inbound ring buffer transitions from empty to  not-empty. Adding an additional message to a ring buffer that is not  empty is not supposed to generate an interrupt on the guest.  Since the guest is waiting in pread() and not removing messages from  the ring buffer, the pread() waits forever.This could be easily reproduced in hv_fcopy_uio_daemon if we delaysetting interrupt mask to 0.Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1,there&#8217;s a race condition. Once user space empties the inbound ringbuffer, but before user space sets interrupt_mask to 0, the host couldput another message in the ring buffer but it wouldn&#8217;t interrupt.Then the next pread() would hang.Fix these by removing all instances where interrupt_mask is changed,while keeping the one in set_event() unchanged to enable userspacecontrol the interrupt mask by writing 0/1 to /dev/uioX.The Linux kernel CVE team has assigned CVE-2025-40048 to this issue.
 openEuler评分：
  6.2
 Vector：CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP2(6.6.0):受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
5.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
6.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel
Closed

Content Risk Flag

Comments (11)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-40048

Comments (11)

Search

src-openEuler/kernel
Closed