184 lines
9.8 KiB
JSON
184 lines
9.8 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-71072",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-01-13T15:30:19.647Z",
|
|
"datePublished": "2026-01-13T15:31:26.089Z",
|
|
"dateUpdated": "2026-10-21T12:38:31.063Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-21T12:38:31.063Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nshmem: fix recovery on rename failures\n\nmaple_tree insertions can fail if we are seriously short on memory;\nsimple_offset_rename() does not recover well if it runs into that.\nThe same goes for simple_offset_rename_exchange().\n\nMoreover, shmem_whiteout() expects that if it succeeds, the caller will\nprogress to d_move(), i.e. that shmem_rename2() won't fail past the\nsuccessful call of shmem_whiteout().\n\nNot hard to fix, fortunately - mtree_store() can't fail if the index we\nare trying to store into is already present in the tree as a singleton.\n\nFor simple_offset_rename_exchange() that's enough - we just need to be\ncareful about the order of operations.\n\nFor simple_offset_rename() solution is to preinsert the target into the\ntree for new_dir; the rest can be done without any potentially failing\noperations.\n\nThat preinsertion has to be done in shmem_rename2() rather than in\nsimple_offset_rename() itself - otherwise we'd need to deal with the\npossibility of failure after successful shmem_whiteout()."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
|
|
"baseScore": 8.2,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - A remote NFS client can invoke ordinary RENAME on a writable tmpfs export through nfsd, reaching shmem_rename2() and the vulnerable offset helpers.\nAC:L - The failure requires severe memory pressure, but an attacker with write access to tmpfs can create files and consume memory while repeatedly attempting renames.\nPR:N - A reasonably configured anonymous writable NFS export can accept AUTH_NULL or mapped AUTH_SYS clients without prior authentication, subject only to directory write and search permissions.\nUI:N - The attacker directly sends rename operations and does not require a victim to perform any action.\nS:U - The corrupted directory state and resulting denial of service remain within the host kernel and filesystem security authority.\nC:N - The failure loses directory-offset mappings but creates no stale freed-object access, out-of-bounds read, or other information-disclosure primitive.\nI:L - A failed insertion can persistently desynchronize a live dentry from its maple-tree mapping, corrupting directory metadata and cookies, but it does not provide arbitrary data modification.\nA:H - The corrupted offsets can make local getdents or NFS READDIR repeat, omit, or fail to progress through entries, potentially rendering the exported directory unavailable to clients."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/libfs.c",
|
|
"include/linux/fs.h",
|
|
"mm/shmem.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
|
|
"lessThan": "8fdbc6f9a994eb327868a4aa74a58953f31a2d0f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
|
|
"lessThan": "4b0fe71fb3965d0db83cdfc2f4fe0b3227d70113",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
|
|
"lessThan": "4642686699a46718d7f2fb5acd1e9d866a9d9cca",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
|
|
"lessThan": "e1b4c6a58304fd490124cc2b454d80edc786665c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/libfs.c",
|
|
"include/linux/fs.h",
|
|
"mm/shmem.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.6",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.6",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.64",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.3",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.19",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.6",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.6",
|
|
"versionEndExcluding": "6.12.64"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.6",
|
|
"versionEndExcluding": "6.18.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.6",
|
|
"versionEndExcluding": "6.19"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8fdbc6f9a994eb327868a4aa74a58953f31a2d0f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4b0fe71fb3965d0db83cdfc2f4fe0b3227d70113"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4642686699a46718d7f2fb5acd1e9d866a9d9cca"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e1b4c6a58304fd490124cc2b454d80edc786665c"
|
|
}
|
|
],
|
|
"title": "shmem: fix recovery on rename failures",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |