| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-21731: nbd: don't allow reconnect after disconnect |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| nbd: don't allow reconnect after disconnect |
| |
| Following process can cause nbd_config UAF: |
| |
| 1) grab nbd_config temporarily; |
| |
| 2) nbd_genl_disconnect() flush all recv_work() and release the |
| initial reference: |
| |
| nbd_genl_disconnect |
| nbd_disconnect_and_put |
| nbd_disconnect |
| flush_workqueue(nbd->recv_workq) |
| if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) |
| nbd_config_put |
| -> due to step 1), reference is still not zero |
| |
| 3) nbd_genl_reconfigure() queue recv_work() again; |
| |
| nbd_genl_reconfigure |
| config = nbd_get_config_unlocked(nbd) |
| if (!config) |
| -> succeed |
| if (!test_bit(NBD_RT_BOUND, ...)) |
| -> succeed |
| nbd_reconnect_socket |
| queue_work(nbd->recv_workq, &args->work) |
| |
| 4) step 1) release the reference; |
| |
| 5) Finially, recv_work() will trigger UAF: |
| |
| recv_work |
| nbd_config_put(nbd) |
| -> nbd_config is freed |
| atomic_dec(&config->recv_threads) |
| -> UAF |
| |
| Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so |
| that nbd_genl_reconfigure() will fail. |
| |
| The Linux kernel CVE team has assigned CVE-2025-21731 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.12 with commit b7aa3d39385dc2d95899f9e379623fef446a2acd and fixed in 5.4.291 with commit e70a578487a47d7cf058904141e586684d1c3381 |
| Issue introduced in 4.12 with commit b7aa3d39385dc2d95899f9e379623fef446a2acd and fixed in 5.10.235 with commit 6bef6222a3f6c7adb6396f77f25a3579d821b09a |
| Issue introduced in 4.12 with commit b7aa3d39385dc2d95899f9e379623fef446a2acd and fixed in 5.15.179 with commit e3be8862d73cac833e0fb7602636c19c6cb94b11 |
| Issue introduced in 4.12 with commit b7aa3d39385dc2d95899f9e379623fef446a2acd and fixed in 6.1.129 with commit e7343fa33751cb07c1c56b666bf37cfca357130e |
| Issue introduced in 4.12 with commit b7aa3d39385dc2d95899f9e379623fef446a2acd and fixed in 6.6.76 with commit d208d2c52b652913b5eefc8ca434b0d6b757f68f |
| Issue introduced in 4.12 with commit b7aa3d39385dc2d95899f9e379623fef446a2acd and fixed in 6.12.13 with commit a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739 |
| Issue introduced in 4.12 with commit b7aa3d39385dc2d95899f9e379623fef446a2acd and fixed in 6.13.2 with commit 9793bd5ae4bdbdb2dde401a3cab94a6bfd05e302 |
| Issue introduced in 4.12 with commit b7aa3d39385dc2d95899f9e379623fef446a2acd and fixed in 6.14 with commit 844b8cdc681612ff24df62cdefddeab5772fadf1 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-21731 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/block/nbd.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/e70a578487a47d7cf058904141e586684d1c3381 |
| https://git.kernel.org/stable/c/6bef6222a3f6c7adb6396f77f25a3579d821b09a |
| https://git.kernel.org/stable/c/e3be8862d73cac833e0fb7602636c19c6cb94b11 |
| https://git.kernel.org/stable/c/e7343fa33751cb07c1c56b666bf37cfca357130e |
| https://git.kernel.org/stable/c/d208d2c52b652913b5eefc8ca434b0d6b757f68f |
| https://git.kernel.org/stable/c/a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739 |
| https://git.kernel.org/stable/c/9793bd5ae4bdbdb2dde401a3cab94a6bfd05e302 |
| https://git.kernel.org/stable/c/844b8cdc681612ff24df62cdefddeab5772fadf1 |
