248 lines
15 KiB
JSON
248 lines
15 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-21899",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-12-29T08:45:45.783Z",
|
|
"datePublished": "2025-04-01T15:26:50.791Z",
|
|
"dateUpdated": "2026-10-15T21:51:55.265Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:55:14.373Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix bad hist from corrupting named_triggers list\n\nThe following commands causes a crash:\n\n ~# cd /sys/kernel/tracing/events/rcu/rcu_callback\n ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger\n bash: echo: write error: Invalid argument\n ~# echo 'hist:name=bad:keys=common_pid' > trigger\n\nBecause the following occurs:\n\nevent_trigger_write() {\n trigger_process_regex() {\n event_hist_trigger_parse() {\n\n data = event_trigger_alloc(..);\n\n event_trigger_register(.., data) {\n cmd_ops->reg(.., data, ..) [hist_register_trigger()] {\n data->ops->init() [event_hist_trigger_init()] {\n save_named_trigger(name, data) {\n list_add(&data->named_list, &named_triggers);\n }\n }\n }\n }\n\n ret = create_actions(); (return -EINVAL)\n if (ret)\n goto out_unreg;\n[..]\n ret = hist_trigger_enable(data, ...) {\n list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!)\n[..]\n out_unreg:\n event_hist_unregister(.., data) {\n cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] {\n list_for_each_entry(iter, &file->triggers, list) {\n if (!hist_trigger_match(data, iter, named_data, false)) <- never matches\n continue;\n [..]\n test = iter;\n }\n if (test && test->ops->free) <<<-- test is NULL\n\n test->ops->free(test) [event_hist_trigger_free()] {\n [..]\n if (data->name)\n del_named_trigger(data) {\n list_del(&data->named_list); <<<<-- NEVER gets removed!\n }\n }\n }\n }\n\n [..]\n kfree(data); <<<-- frees item but it is still on list\n\nThe next time a hist with name is registered, it causes an u-a-f bug and\nthe kernel can crash.\n\nMove the code around such that if event_trigger_register() succeeds, the\nnext thing called is hist_trigger_enable() which adds it to the list.\n\nA bunch of actions is called if get_named_trigger_data() returns false.\nBut that doesn't need to be called after event_trigger_register(), so it\ncan be moved up, allowing event_trigger_register() to be called just\nbefore hist_trigger_enable() keeping them together and allowing the\nfile->triggers to be properly populated."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerability is reached only by writing a hist trigger command to a tracefs file (`/sys/kernel/tracing/events/*/trigger`) via the write(2) syscall. There is no network or remote data path into `event_hist_trigger_parse()`.\nAC:L - Triggering is fully deterministic — one failing `hist:name=bad:...onmax(bogus)...` write leaves the freed object linked in the global `named_triggers` list, and a second `hist:name=bad` write dereferences it; no race and no uncontrollable preconditions. `CONFIG_HIST_TRIGGERS=y` is standard in mainstream distro and Android kernels, and slab reclaim of the freed `event_trigger_data` is attacker-influenced via ordinary heap spraying.\nPR:L - No capability check exists on the code path; access is gated purely by tracefs file permissions, and tracefs is routinely delegated to a non-root tracing/shell group (Android shell, ChromeOS debugd, perf/tracing groups) via the `gid=` mount option. A local unprivileged user with that ordinary tracing access can execute the full sequence.\nUI:N - The attacker performs both writes themselves; no victim action or cooperation is needed at any point.\nS:U - The use-after-free and list corruption occur in kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `find_named_trigger()` and `hist_trigger_match()` dereference the freed object's `name` and `private_data` pointers, so after reclaiming the slab object the attacker controls those pointers and obtains an arbitrary kernel-memory read primitive, plus leakage of the `named_triggers` list-head address.\nI:H - The freed object remains on a global list, so subsequent `list_add`/`list_del` operations write through attacker-controlled `named_list` pointers, and `data->private_data = named_data->private_data` produces type confusion into `hist_trigger_data` — a classic UAF write primitive usable for control-flow hijack.\nA:H - As stated in the commit, the second named-hist registration causes a use-after-free that crashes the kernel; list corruption reliably produces an oops or panic, denying service to the whole system."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/trace/trace_events_hist.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
|
|
"lessThan": "5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
|
|
"lessThan": "43b254d46c740bf9dbe65709afa021dd726dfa99",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
|
|
"lessThan": "435d2964af815aae456db554c62963b4515f19d0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
|
|
"lessThan": "f1ae50cfb818ce1ac7a674406dfadb7653e2552d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
|
|
"lessThan": "6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/trace/trace_events_hist.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.17",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.17",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.130",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.81",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.18",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.13.6",
|
|
"lessThanOrEqual": "6.13.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.14",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "6.1.130"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "6.6.81"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "6.12.18"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "6.13.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "6.14"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/43b254d46c740bf9dbe65709afa021dd726dfa99"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/435d2964af815aae456db554c62963b4515f19d0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f1ae50cfb818ce1ac7a674406dfadb7653e2552d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e"
|
|
}
|
|
],
|
|
"title": "tracing: Fix bad hist from corrupting named_triggers list",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2025-11-03T19:38:45.924Z"
|
|
}
|
|
},
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2025-21899",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:43:39.275390Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T21:51:55.265Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |