cve/published/2025/CVE-2025-22062.mbox

From bippy-1.2.0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@kernel.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2025-22062: sctp: add mutual exclusion in proc_sctp_do_udp_port()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sctp: add mutual exclusion in proc_sctp_do_udp_port()

We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start()
or risk a crash as syzbot reported:

Oops: general protection fault, probably for non-canonical address 0xdffffc000000000d: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]
CPU: 1 UID: 0 PID: 6551 Comm: syz.1.44 Not tainted 6.14.0-syzkaller-g7f2ff7b62617 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
 RIP: 0010:kernel_sock_shutdown+0x47/0x70 net/socket.c:3653
Call Trace:
 <TASK>
  udp_tunnel_sock_release+0x68/0x80 net/ipv4/udp_tunnel_core.c:181
  sctp_udp_sock_stop+0x71/0x160 net/sctp/protocol.c:930
  proc_sctp_do_udp_port+0x264/0x450 net/sctp/sysctl.c:553
  proc_sys_call_handler+0x3d0/0x5b0 fs/proc/proc_sysctl.c:601
  iter_file_splice_write+0x91c/0x1150 fs/splice.c:738
  do_splice_from fs/splice.c:935 [inline]
  direct_splice_actor+0x18f/0x6c0 fs/splice.c:1158
  splice_direct_to_actor+0x342/0xa30 fs/splice.c:1102
  do_splice_direct_actor fs/splice.c:1201 [inline]
  do_splice_direct+0x174/0x240 fs/splice.c:1227
  do_sendfile+0xafd/0xe50 fs/read_write.c:1368
  __do_sys_sendfile64 fs/read_write.c:1429 [inline]
  __se_sys_sendfile64 fs/read_write.c:1415 [inline]
  __x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1415
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]

The Linux kernel CVE team has assigned CVE-2025-22062 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 5.15.184 with commit 65ccb2793da7401772a3ffe85355c831b313c59f
	Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 6.1.140 with commit 386507cb6fb7cdef598ddcb3f0fa37e6ca9e789d
	Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 6.6.92 with commit b3598f53211ba1025485306de2733bdd241311a3
	Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 6.12.23 with commit e5178bfc55b3a78000f0f8298e7ade88783ce581
	Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 6.13.11 with commit efb8cb487be8f4ba6aaef616011d702d6a083ed1
	Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 6.14.2 with commit d3d7675d77622f6ca1aae14c51f80027b36283f8
	Issue introduced in 5.11 with commit 046c052b475e7119b6a30e3483e2888fc606a2f8 and fixed in 6.15 with commit 10206302af856791fbcc27a33ed3c3eb09b2793d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-22062
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sctp/sysctl.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/65ccb2793da7401772a3ffe85355c831b313c59f
	https://git.kernel.org/stable/c/386507cb6fb7cdef598ddcb3f0fa37e6ca9e789d
	https://git.kernel.org/stable/c/b3598f53211ba1025485306de2733bdd241311a3
	https://git.kernel.org/stable/c/e5178bfc55b3a78000f0f8298e7ade88783ce581
	https://git.kernel.org/stable/c/efb8cb487be8f4ba6aaef616011d702d6a083ed1
	https://git.kernel.org/stable/c/d3d7675d77622f6ca1aae14c51f80027b36283f8
	https://git.kernel.org/stable/c/10206302af856791fbcc27a33ed3c3eb09b2793d