167 lines
11 KiB
JSON
167 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-39723",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T07:20:57.117Z",
|
|
"datePublished": "2025-09-05T17:21:31.137Z",
|
|
"dateUpdated": "2026-08-05T12:04:52.373Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:04:52.373Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix unbuffered write error handling\n\nIf all the subrequests in an unbuffered write stream fail, the subrequest\ncollector doesn't update the stream->transferred value and it retains its\ninitial LONG_MAX value. Unfortunately, if all active streams fail, then we\ntake the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set\nin wreq->transferred - which is then returned from ->write_iter().\n\nLONG_MAX was chosen as the initial value so that all the streams can be\nquickly assessed by taking the smallest value of all stream->transferred -\nbut this only works if we've set any of them.\n\nFix this by adding a flag to indicate whether the value in\nstream->transferred is valid and checking that when we integrate the\nvalues. stream->transferred can then be initialised to zero.\n\nThis was found by running the generic/750 xfstest against cifs with\ncache=none. It splices data to the target file. Once (if) it has used up\nall the available scratch space, the writes start failing with ENOSPC.\nThis causes ->write_iter() to fail. However, it was returning\nwreq->transferred, i.e. LONG_MAX, rather than an error (because it thought\nthe amount transferred was non-zero) and iter_file_splice_write() would\nthen try to clean up that amount of pipe bufferage - leading to an oops\nwhen it overran. The kernel log showed:\n\n CIFS: VFS: Send error in write = -28\n\nfollowed by:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n\nwith:\n\n RIP: 0010:iter_file_splice_write+0x3a4/0x520\n do_splice+0x197/0x4e0\n\nor:\n\n RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282)\n iter_file_splice_write (fs/splice.c:755)\n\nAlso put a warning check into splice to announce if ->write_iter() returned\nthat it had written more than it was asked to."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
|
|
"baseScore": 7.1,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The netfs write collector processes write results derived from a remote SMB/9p server's responses, and the arming condition (every write subrequest failing) is entirely under the remote server's control — a malicious, compromised, or MITM'd file server simply returns STATUS_DISK_FULL/ACCESS_DENIED for the writes and the client kernel oopses. The vulnerable component is bound to the network stack via the cifs/9p transport.\nAC:L - The failure is deterministic: LONG_MAX always exceeds the total bytes held in the pipe, so the splice cleanup loop unconditionally runs past the valid buffers into a slot with NULL ops and faults. No race, no memory-layout dependency, no non-default config (cifs/9p with cache=none, or any O_DIRECT open).\nPR:N - A remote file server needs no credentials or privileges on the victim client to return write errors; in the equivalent local framing an ordinary unprivileged user with write access to the mount triggers it via splice()/cp with no capabilities at all.\nUI:R - The remote attacker cannot initiate the transfer itself — a client-side process must perform a splice-based write (splice/sendfile/copy_file_range, e.g. a routine `cp` onto the mounted share) for the bogus LONG_MAX return to reach iter_file_splice_write().\nS:U - The corruption and crash are confined to the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The fault is a NULL function-pointer dereference and pipe-ring state corruption; it yields no read primitive and discloses no kernel or file data to the attacker.\nI:L - ->write_iter() reports 0x7fffffffffffffff bytes written when nothing was written, so applications treat failed writes as successful (silent data loss), netfs_update_i_size() stamps a bogus/overflowed size onto the client inode, and the splice loop destroys unwritten pipe contents and leaves pipe->tail past pipe->head — limited, non-arbitrary data and metadata corruption.\nA:H - Reliable kernel NULL pointer dereference oops in iter_file_splice_write()/pipe_buf_release(), taken with the pipe mutex held, so the pipe is permanently locked and any other user of it hangs in D state; on panic_on_oops configurations it is a full system panic."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/netfs/read_collect.c",
|
|
"fs/netfs/write_collect.c",
|
|
"fs/netfs/write_issue.c",
|
|
"fs/splice.c",
|
|
"include/linux/netfs.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
|
|
"lessThan": "f08c80af3c9a9849cd178b4843b7c01d103506a1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
|
|
"lessThan": "387164a2b97e1f5404c6d0049a7409bac7d2bc5b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "288ace2f57c9d06dd2e42bd80d03747d879a4068",
|
|
"lessThan": "a3de58b12ce074ec05b8741fa28d62ccb1070468",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/netfs/read_collect.c",
|
|
"fs/netfs/write_collect.c",
|
|
"fs/netfs/write_issue.c",
|
|
"fs/splice.c",
|
|
"include/linux/netfs.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.10",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.10",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.44",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.16.4",
|
|
"lessThanOrEqual": "6.16.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.17",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.10",
|
|
"versionEndExcluding": "6.12.44"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.10",
|
|
"versionEndExcluding": "6.16.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.10",
|
|
"versionEndExcluding": "6.17"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f08c80af3c9a9849cd178b4843b7c01d103506a1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/387164a2b97e1f5404c6d0049a7409bac7d2bc5b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a3de58b12ce074ec05b8741fa28d62ccb1070468"
|
|
}
|
|
],
|
|
"title": "netfs: Fix unbuffered write error handling",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |