279 lines
16 KiB
JSON
279 lines
16 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-40123",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T07:20:57.169Z",
|
|
"datePublished": "2025-11-12T10:23:19.589Z",
|
|
"dateUpdated": "2026-10-15T22:02:38.256Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-09-14T11:58:08.635Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Enforce expected_attach_type for tailcall compatibility\n\nYinhao et al. recently reported:\n\n Our fuzzer tool discovered an uninitialized pointer issue in the\n bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.\n This leads to a NULL pointer dereference when a BPF program attempts to\n deference the txq member of struct xdp_buff object.\n\nThe test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the\nentry point for bpf_prog_test_run_xdp() and its expected_attach_type can\nneither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot\nof a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP\nto pass xdp_is_valid_access() validation. The program returns struct xdp_md's\negress_ifindex, and the latter is only allowed to be accessed under mentioned\nexpected_attach_type. progB is then inserted into the tailcall which progA\ncalls.\n\nThe underlying issue goes beyond XDP though. Another example are programs\nof type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well\nas sock_addr_func_proto() have different logic depending on the programs'\nexpected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME\nshould not be allowed doing a tailcall into a program which calls bpf_bind()\nout of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.\n\nIn short, specifying expected_attach_type allows to open up additional\nfunctionality or restrictions beyond what the basic bpf_prog_type enables.\nThe use of tailcalls must not violate these constraints. Fix it by enforcing\nexpected_attach_type in __bpf_prog_map_compatible().\n\nNote that we only enforce this for tailcall maps, but not for BPF devmaps or\ncpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and\ncpu_map_bpf_prog_run*() which set up a new environment / context and therefore\nthese situations are not prone to this issue."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerability is reached through the bpf(2) syscall — loading two programs with differing expected_attach_type, populating a BPF_MAP_TYPE_PROG_ARRAY, and invoking the tail call via BPF_PROG_TEST_RUN or a live attach. No network-supplied data introduces the incompatible tail call, so local access is required.\nAC:L - Exploitation is fully deterministic: the attacker authors and loads both programs, owns the prog array, and controls exactly when the tail call executes; there is no race and no memory-layout condition needed for the mis-typed context dereference to occur.\nPR:L - A basic local user with BPF program-loading access can create the prog array and the two mismatched programs; this matches the established scoring of comparable BPF verifier-constraint bypasses, and containerized/delegated-token deployments grant exactly this level without full administrative rights.\nUI:N - The attacker performs every step — program load, map update, and program invocation — entirely on their own; no victim action or cooperation is involved.\nS:U - The mis-typed context dereference and any resulting corruption occur within the kernel that is already the vulnerable component, so impact stays inside a single security authority.\nC:H - xdp_init_buff() never initializes xdp_buff->txq, so a tail-called BPF_XDP_DEVMAP program reading egress_ifindex dereferences attacker-groomable uninitialized stack memory twice and returns the resulting kernel dword into BPF, which can be exfiltrated through a map — an effectively arbitrary kernel read primitive.\nI:H - Bypassing expected_attach_type lets a program execute helpers and context writes the running hook never validated — e.g. bpf_bind()/__inet_bind() invoked from a GETPEERNAME hook mutates live socket binding and hash state without the socket lock, and msg_src_ip4/6 or sockopt level/optname/retval writes land on NULL or wrong-type kernel fields.\nA:H - The reported case is an immediate NULL pointer dereference on xdp_buff->txq in bpf_prog_test_run_xdp(), and in driver XDP paths the uninitialized txq produces a wild pointer dereference — either way a kernel oops that the attacker can trigger repeatedly."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"include/linux/bpf.h",
|
|
"kernel/bpf/core.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
|
|
"lessThan": "e53a59e7cee5c1605d1ed595933098c2b69108f9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
|
|
"lessThan": "dc4f348952173beb8ceb15be30b249276eccb605",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
|
|
"lessThan": "a99de19128aec0913f3d529f529fbbff5edfaff8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
|
|
"lessThan": "08cb3dc9d2b44f153d0bcf2cb966e4a94b5d0f32",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
|
|
"lessThan": "f856c598080ba7ce1252867b8ecd6ad5bdaf9a6a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
|
|
"lessThan": "c1ad19b5d8e23123503dcaf2d4342e1b90b923ad",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5e43f899b03a3492ce5fc44e8900becb04dae9c0",
|
|
"lessThan": "4540aed51b12bc13364149bf95f6ecef013197c0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"include/linux/bpf.h",
|
|
"kernel/bpf/core.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.17",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.17",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.270",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.221",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.156",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.112",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.53",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.17.3",
|
|
"lessThanOrEqual": "6.17.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "5.10.270"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "5.15.221"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "6.1.156"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "6.6.112"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "6.12.53"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "6.17.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.17",
|
|
"versionEndExcluding": "6.18"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e53a59e7cee5c1605d1ed595933098c2b69108f9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/dc4f348952173beb8ceb15be30b249276eccb605"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a99de19128aec0913f3d529f529fbbff5edfaff8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/08cb3dc9d2b44f153d0bcf2cb966e4a94b5d0f32"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f856c598080ba7ce1252867b8ecd6ad5bdaf9a6a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c1ad19b5d8e23123503dcaf2d4342e1b90b923ad"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4540aed51b12bc13364149bf95f6ecef013197c0"
|
|
}
|
|
],
|
|
"title": "bpf: Enforce expected_attach_type for tailcall compatibility",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2025-40123",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:57:04.979824Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T22:02:38.256Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |