214 lines
13 KiB
JSON
214 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-21976",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-12-29T08:45:45.798Z",
|
|
"datePublished": "2025-04-01T15:47:07.120Z",
|
|
"dateUpdated": "2026-10-21T12:36:12.299Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-21T12:36:12.299Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: hyperv_fb: Allow graceful removal of framebuffer\n\nWhen a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to\nrelease the framebuffer forcefully. If this framebuffer is in use it\nproduce the following WARN and hence this framebuffer is never released.\n\n[ 44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40\n< snip >\n[ 44.111289] Call Trace:\n[ 44.111290] <TASK>\n[ 44.111291] ? show_regs+0x6c/0x80\n[ 44.111295] ? __warn+0x8d/0x150\n[ 44.111298] ? framebuffer_release+0x2c/0x40\n[ 44.111300] ? report_bug+0x182/0x1b0\n[ 44.111303] ? handle_bug+0x6e/0xb0\n[ 44.111306] ? exc_invalid_op+0x18/0x80\n[ 44.111308] ? asm_exc_invalid_op+0x1b/0x20\n[ 44.111311] ? framebuffer_release+0x2c/0x40\n[ 44.111313] ? hvfb_remove+0x86/0xa0 [hyperv_fb]\n[ 44.111315] vmbus_remove+0x24/0x40 [hv_vmbus]\n[ 44.111323] device_remove+0x40/0x80\n[ 44.111325] device_release_driver_internal+0x20b/0x270\n[ 44.111327] ? bus_find_device+0xb3/0xf0\n\nFix this by moving the release of framebuffer and assosiated memory\nto fb_ops.fb_destroy function, so that framebuffer framework handles\nit gracefully.\n\nWhile we fix this, also replace manual registrations/unregistration of\nframebuffer with devm_register_framebuffer."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerability is reached through local interfaces only — opening and mmap'ing the `/dev/fbN` character device and the local/administrative device-removal path (sysfs unbind, module unload, or VMBus rescind of the guest's synthetic video device). No network or adjacent-network vector exists for hyperv_fb.\nAC:L - There is no race to win: a process simply holds an mmap of `/dev/fb0`, and the premature `vfree()`/`kvfree()` in `hvfb_remove()` deterministically leaves that mapping and the `info->pagerefs` array pointing at freed memory. Grooming the recycled pages afterwards is under the attacker's control via ordinary allocation pressure.\nPR:L - The party that gains the freed-memory read/write primitive only needs to open and mmap the framebuffer device, which unprivileged seat/console users (logind ACLs), `video`-group members, and graphics-domain processes on embedded/Android-style systems routinely can do. No CAP_SYS_ADMIN is needed to hold the mapping that survives the teardown.\nUI:N - The removal that triggers the free is a device/administrative event — Hyper-V host-side rescind of the video VMBus device, driver reload during a package update, or automated unbind — not an action by a victim user, and the attacking process merely has to be mapped when it occurs. This matches the treatment of the identical fbdev hot-unplug-while-mapped class.\nS:U - The corrupted resources (vmalloc pages, the deferred-I/O pageref array, the leaked `fb_info`) are all kernel memory managed by the same security authority as the vulnerable driver. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - After `vfree(par->dio_vp)` the surviving userspace mapping still points at pages handed back to the page allocator, so the attacker can read whatever kernel data those pages are subsequently reused for — slab objects, page tables, credentials — an effectively arbitrary kernel memory disclosure.\nI:H - The same surviving mapping is writable, giving a page-granularity write primitive into recycled kernel memory, and write faults additionally corrupt the kvfree'd `info->pagerefs` array and lock a destroyed mutex. That combination is a classic path to heap/page-table corruption and control-flow hijack.\nA:H - Unbind with the framebuffer in use produces a `WARN_ON` in `framebuffer_release()` (fatal under panic_on_warn) plus an `fb_info` leak, and subsequent access from the still-open fd faults on freed vmalloc memory, walks a freed pageref array, and locks a destroyed mutex — resulting in oops/panic."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/video/fbdev/hyperv_fb.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "68a2d20b79b105f02dcbc52c211d7e62f98996b7",
|
|
"lessThan": "b1a86a5ab0d44160534f495a3630646092d98e27",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "68a2d20b79b105f02dcbc52c211d7e62f98996b7",
|
|
"lessThan": "4545e2aa121aea304d33903099c03e29ed4fe50a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "68a2d20b79b105f02dcbc52c211d7e62f98996b7",
|
|
"lessThan": "a7b583dc99c6cf4a96877017be1d08247e1ef2c7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "68a2d20b79b105f02dcbc52c211d7e62f98996b7",
|
|
"lessThan": "ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/video/fbdev/hyperv_fb.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "3.10",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "3.10",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.20",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.13.8",
|
|
"lessThanOrEqual": "6.13.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.14",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.10",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.10",
|
|
"versionEndExcluding": "6.12.20"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.10",
|
|
"versionEndExcluding": "6.13.8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.10",
|
|
"versionEndExcluding": "6.14"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b1a86a5ab0d44160534f495a3630646092d98e27"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4545e2aa121aea304d33903099c03e29ed4fe50a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a7b583dc99c6cf4a96877017be1d08247e1ef2c7"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ea2f45ab0e53b255f72c85ccd99e2b394fc5fceb"
|
|
}
|
|
],
|
|
"title": "fbdev: hyperv_fb: Allow graceful removal of framebuffer",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2025-21976",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:43:57.399849Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T21:51:56.270Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |