CVE-2025-21661

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21661
In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix missing lookup table cleanups When a virtuser device is created via configfs and the probe fails due to an incorrect lookup table, the table is not removed. This prevents subsequent probe attempts from succeeding, even if the issue is corrected, unless the device is released. Additionally, cleanup is also needed in the less likely case of platform_device_register_full() failure. Besides, a consistent memory leak in lookup_table->dev_id was spotted using kmemleak by toggling the live state between 0 and 1 with a correct lookup table. Introduce gpio_virtuser_remove_lookup_table() as the counterpart to the existing gpio_virtuser_make_lookup_table() and call it from all necessary points to ensure proper cleanup.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/a619cba8c69c434258ff4101d463322cd63e1bdc Patch
https://git.kernel.org/stable/c/d72d0126b1f6981f6ce8b4247305f359958c11b5 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
History

28 Feb 2025, 18:59

Type Values Removed Values Added
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/a619cba8c69c434258ff4101d463322cd63e1bdc - () https://git.kernel.org/stable/c/a619cba8c69c434258ff4101d463322cd63e1bdc - Patch
References () https://git.kernel.org/stable/c/d72d0126b1f6981f6ce8b4247305f359958c11b5 - () https://git.kernel.org/stable/c/d72d0126b1f6981f6ce8b4247305f359958c11b5 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gpio: virtuser: corregir limpiezas de tablas de búsqueda faltantes Cuando se crea un dispositivo virtuser a través de configfs y la sonda falla debido a una tabla de búsqueda incorrecta, la tabla no se elimina. Esto evita que los intentos de sonda posteriores tengan éxito, incluso si se corrige el problema, a menos que se libere el dispositivo. Además, también se necesita limpieza en el caso menos probable de que falle platform_device_register_full(). Además, se detectó una pérdida de memoria constante en lookup_table->dev_id usando kmemleak alternando el estado activo entre 0 y 1 con una tabla de búsqueda correcta. Introduzca gpio_virtuser_remove_lookup_table() como contraparte del gpio_virtuser_make_lookup_table() existente y llámelo desde todos los puntos necesarios para garantizar una limpieza adecuada.

21 Jan 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-21 13:15

Updated : 2025-02-28 18:59

NVD link : CVE-2025-21661

Mitre link : CVE-2025-21661

CVE.ORG link : CVE-2025-21661

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime