VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2025/39xxx/CVE-2025-39902.json
T

314 lines
17 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-39902",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2025-04-16T07:20:57.146Z",
"datePublished": "2025-10-01T07:42:49.415Z",
"dateUpdated": "2026-10-15T22:02:32.999Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-08-05T12:05:59.784Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: avoid accessing metadata when pointer is invalid in object_err()\n\nobject_err() reports details of an object for further debugging, such as\nthe freelist pointer, redzone, etc. However, if the pointer is invalid,\nattempting to access object metadata can lead to a crash since it does\nnot point to a valid object.\n\nOne known path to the crash is when alloc_consistency_checks()\ndetermines the pointer to the allocated object is invalid because of a\nfreelist corruption, and calls object_err() to report it. The debug code\nshould report and handle the corruption gracefully and not crash in the\nprocess.\n\nIn case the pointer is NULL or check_valid_pointer() returns false for\nthe pointer, only print the pointer value and skip accessing metadata."
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is in the SLUB allocator's debug reporting path, reached from `___slab_alloc` when a local attacker's heap-corruption primitive (slab overflow, double free, or UAF) has poisoned a freelist pointer; no remote or adjacent network input reaches `object_err()` directly.\nAC:L - The attacker who corrupts the freelist fully controls the invalid pointer value and can force `check_valid_pointer()` to fail deterministically on the very next allocation from that slab, triggering the wild dereference reliably and repeatedly; on any deployment booted with `slab_debug`/`CONFIG_SLUB_DEBUG_ON` (Android userdebug, distro debug kernels, embedded and automotive bring-up images, CI fleets) no attacker-uncontrollable condition remains.\nPR:L - Reaching the slab allocator requires only that the attacker run code that allocates kernel memory, and the freelist-corrupting primitives that lead here are routinely reachable by unprivileged local users through ordinary syscalls; no capability check exists anywhere on the path from `kmem_cache_alloc()` to `object_err()`.\nUI:N - The attacker triggers the corruption and the subsequent allocation from its own process; no victim action, mount, or file open is required.\nS:U - The faulting read and its consequences are entirely within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `print_trailer()` hex-dumps memory at the attacker-influenced pointer — `print_section()` on \"Redzone\", \"Object\" (up to PAGE_SIZE bytes), and \"Padding\", plus `struct track` contents and `get_freepointer()` — straight into the kernel log, so an attacker who chooses the freepointer value (plaintext absent `CONFIG_SLAB_FREELIST_HARDENED`) obtains an out-of-bounds read of arbitrary kernel memory disclosing pointers, canaries, and secrets.\nI:N - Every access on the buggy path (`print_tracking`, `get_freepointer`, `print_section`) is a read; the `set_freepointer()` fixups in `check_object()`/`on_freelist()` operate on already-validated pointers, so this defect yields no kernel write primitive of its own.\nA:H - Dereferencing the invalid pointer in `print_tracking()`/`print_section()` faults on unmapped or non-canonical memory, oopsing the kernel from inside the allocator slow path while holding `n->list_lock`, which is an unrecoverable crash rather than the graceful corruption report the code intended."
}
]
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"mm/slub.c"
],
"versions": [
{
"version": "81819f0fc8285a2a5a921c019e3e3d7b6169d225",
"lessThan": "872f2c34ff232af1e65ad2df86d61163c8ffad42",
"status": "affected",
"versionType": "git"
},
{
"version": "81819f0fc8285a2a5a921c019e3e3d7b6169d225",
"lessThan": "f66012909e7bf383fcdc5850709ed5716073fdc4",
"status": "affected",
"versionType": "git"
},
{
"version": "81819f0fc8285a2a5a921c019e3e3d7b6169d225",
"lessThan": "7e287256904ee796c9477e3ec92b07f236481ef3",
"status": "affected",
"versionType": "git"
},
{
"version": "81819f0fc8285a2a5a921c019e3e3d7b6169d225",
"lessThan": "1f0797f17927b5cad0fb7eced422f9a7c30a3191",
"status": "affected",
"versionType": "git"
},
{
"version": "81819f0fc8285a2a5a921c019e3e3d7b6169d225",
"lessThan": "0ef7058b4dc6fcef622ac23b45225db57f17b83f",
"status": "affected",
"versionType": "git"
},
{
"version": "81819f0fc8285a2a5a921c019e3e3d7b6169d225",
"lessThan": "dda6ec365ab04067adae40ef17015db447e90736",
"status": "affected",
"versionType": "git"
},
{
"version": "81819f0fc8285a2a5a921c019e3e3d7b6169d225",
"lessThan": "3baa1da473e6e50281324ff1d332d1a07a3bb02e",
"status": "affected",
"versionType": "git"
},
{
"version": "81819f0fc8285a2a5a921c019e3e3d7b6169d225",
"lessThan": "b4efccec8d06ceb10a7d34d7b1c449c569d53770",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"mm/slub.c"
],
"versions": [
{
"version": "2.6.22",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.22",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.4.299",
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.243",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.192",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.151",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.105",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.12.46",
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.16.6",
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.17",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.22",
"versionEndExcluding": "5.4.299"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.22",
"versionEndExcluding": "5.10.243"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.22",
"versionEndExcluding": "5.15.192"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.22",
"versionEndExcluding": "6.1.151"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.22",
"versionEndExcluding": "6.6.105"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.22",
"versionEndExcluding": "6.12.46"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.22",
"versionEndExcluding": "6.16.6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.22",
"versionEndExcluding": "6.17"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/872f2c34ff232af1e65ad2df86d61163c8ffad42"
},
{
"url": "https://git.kernel.org/stable/c/f66012909e7bf383fcdc5850709ed5716073fdc4"
},
{
"url": "https://git.kernel.org/stable/c/7e287256904ee796c9477e3ec92b07f236481ef3"
},
{
"url": "https://git.kernel.org/stable/c/1f0797f17927b5cad0fb7eced422f9a7c30a3191"
},
{
"url": "https://git.kernel.org/stable/c/0ef7058b4dc6fcef622ac23b45225db57f17b83f"
},
{
"url": "https://git.kernel.org/stable/c/dda6ec365ab04067adae40ef17015db447e90736"
},
{
"url": "https://git.kernel.org/stable/c/3baa1da473e6e50281324ff1d332d1a07a3bb02e"
},
{
"url": "https://git.kernel.org/stable/c/b4efccec8d06ceb10a7d34d7b1c449c569d53770"
}
],
"title": "mm/slub: avoid accessing metadata when pointer is invalid in object_err()",
"x_generator": {
"engine": "bippy-1.2.0"
}
},
"adp": [
{
"title": "CVE Program Container",
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2025-11-03T17:44:33.198Z"
}
},
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2025-39902",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-10-15T21:54:38.930497Z"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-10-15T22:02:32.999Z"
}
}
]
}
}
View Git Blame Copy Permalink