| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-21647: sched: sch_cake: add bounds checks to host bulk flow fairness counts |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| sched: sch_cake: add bounds checks to host bulk flow fairness counts |
| |
| Even though we fixed a logic error in the commit cited below, syzbot |
| still managed to trigger an underflow of the per-host bulk flow |
| counters, leading to an out of bounds memory access. |
| |
| To avoid any such logic errors causing out of bounds memory accesses, |
| this commit factors out all accesses to the per-host bulk flow counters |
| to a series of helpers that perform bounds-checking before any |
| increments and decrements. This also has the benefit of improving |
| readability by moving the conditional checks for the flow mode into |
| these helpers, instead of having them spread out throughout the |
| code (which was the cause of the original logic error). |
| |
| As part of this change, the flow quantum calculation is consolidated |
| into a helper function, which means that the dithering applied to the |
| ost load scaling is now applied both in the DRR rotation and when a |
| sparse flow's quantum is first initiated. The only user-visible effect |
| of this is that the maximum packet size that can be sent while a flow |
| stays sparse will now vary with +/- one byte in some cases. This should |
| not make a noticeable difference in practice, and thus it's not worth |
| complicating the code to preserve the old behaviour. |
| |
| The Linux kernel CVE team has assigned CVE-2025-21647 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.4.284 with commit 4a4eeefa514db570be025ab46d779af180e2c9bb and fixed in 5.4.291 with commit 44fe1efb4961c1a5ccab16bb579dfc6b308ad58b |
| Issue introduced in 5.10.226 with commit 7725152b54d295b7da5e34c2f419539b30d017bd and fixed in 5.10.235 with commit b1a1743aaa4906c41c426eda97e2e2586f79246d |
| Issue introduced in 5.15.167 with commit cde71a5677971f4f1b69b25e854891dbe78066a4 and fixed in 5.15.179 with commit bb0245fa72b783cb23a9949c5048781341e91423 |
| Issue introduced in 6.1.110 with commit 549e407569e08459d16122341d332cb508024094 and fixed in 6.1.125 with commit a777e06dfc72bed73c05dcb437d7c27ad5f90f3f |
| Issue introduced in 6.6.51 with commit d4a9039a7b3d8005b90c7b1a55a306444f0e5447 and fixed in 6.6.72 with commit 27202e2e8721c3b23831563c36ed5ac7818641ba |
| Issue introduced in 6.11 with commit 546ea84d07e3e324644025e2aae2d12ea4c5896e and fixed in 6.12.10 with commit 91bb18950b88f955838ec0c1d97f74d135756dc7 |
| Issue introduced in 6.11 with commit 546ea84d07e3e324644025e2aae2d12ea4c5896e and fixed in 6.13 with commit 737d4d91d35b5f7fa5bb442651472277318b0bfd |
| Issue introduced in 6.10.10 with commit d7c01c0714c04431b5e18cf17a9ea68a553d1c3c |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-21647 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/sched/sch_cake.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/44fe1efb4961c1a5ccab16bb579dfc6b308ad58b |
| https://git.kernel.org/stable/c/b1a1743aaa4906c41c426eda97e2e2586f79246d |
| https://git.kernel.org/stable/c/bb0245fa72b783cb23a9949c5048781341e91423 |
| https://git.kernel.org/stable/c/a777e06dfc72bed73c05dcb437d7c27ad5f90f3f |
| https://git.kernel.org/stable/c/27202e2e8721c3b23831563c36ed5ac7818641ba |
| https://git.kernel.org/stable/c/91bb18950b88f955838ec0c1d97f74d135756dc7 |
| https://git.kernel.org/stable/c/737d4d91d35b5f7fa5bb442651472277318b0bfd |
