CVE-2025-21731

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21731
In the Linux kernel, the following vulnerability has been resolved: nbd: don't allow reconnect after disconnect Following process can cause nbd_config UAF: 1) grab nbd_config temporarily; 2) nbd_genl_disconnect() flush all recv_work() and release the initial reference: nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero 3) nbd_genl_reconfigure() queue recv_work() again; nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work) 4) step 1) release the reference; 5) Finially, recv_work() will trigger UAF: recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/6bef6222a3f6c7adb6396f77f25a3579d821b09a Patch
https://git.kernel.org/stable/c/844b8cdc681612ff24df62cdefddeab5772fadf1 Patch
https://git.kernel.org/stable/c/9793bd5ae4bdbdb2dde401a3cab94a6bfd05e302 Patch
https://git.kernel.org/stable/c/a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739 Patch
https://git.kernel.org/stable/c/d208d2c52b652913b5eefc8ca434b0d6b757f68f Patch
https://git.kernel.org/stable/c/e3be8862d73cac833e0fb7602636c19c6cb94b11 Patch
https://git.kernel.org/stable/c/e70a578487a47d7cf058904141e586684d1c3381 Patch
https://git.kernel.org/stable/c/e7343fa33751cb07c1c56b666bf37cfca357130e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Mar 2025, 18:56

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/6bef6222a3f6c7adb6396f77f25a3579d821b09a - () https://git.kernel.org/stable/c/6bef6222a3f6c7adb6396f77f25a3579d821b09a - Patch
References () https://git.kernel.org/stable/c/844b8cdc681612ff24df62cdefddeab5772fadf1 - () https://git.kernel.org/stable/c/844b8cdc681612ff24df62cdefddeab5772fadf1 - Patch
References () https://git.kernel.org/stable/c/9793bd5ae4bdbdb2dde401a3cab94a6bfd05e302 - () https://git.kernel.org/stable/c/9793bd5ae4bdbdb2dde401a3cab94a6bfd05e302 - Patch
References () https://git.kernel.org/stable/c/a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739 - () https://git.kernel.org/stable/c/a8ee6ecde2b7bfb58c8a3afe8a9d2b848f580739 - Patch
References () https://git.kernel.org/stable/c/d208d2c52b652913b5eefc8ca434b0d6b757f68f - () https://git.kernel.org/stable/c/d208d2c52b652913b5eefc8ca434b0d6b757f68f - Patch
References () https://git.kernel.org/stable/c/e3be8862d73cac833e0fb7602636c19c6cb94b11 - () https://git.kernel.org/stable/c/e3be8862d73cac833e0fb7602636c19c6cb94b11 - Patch
References () https://git.kernel.org/stable/c/e70a578487a47d7cf058904141e586684d1c3381 - () https://git.kernel.org/stable/c/e70a578487a47d7cf058904141e586684d1c3381 - Patch
References () https://git.kernel.org/stable/c/e7343fa33751cb07c1c56b666bf37cfca357130e - () https://git.kernel.org/stable/c/e7343fa33751cb07c1c56b666bf37cfca357130e - Patch

13 Mar 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/6bef6222a3f6c7adb6396f77f25a3579d821b09a -
  • () https://git.kernel.org/stable/c/e3be8862d73cac833e0fb7602636c19c6cb94b11 -
  • () https://git.kernel.org/stable/c/e70a578487a47d7cf058904141e586684d1c3381 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nbd: no permitir la reconexión después de la desconexión El siguiente proceso puede causar el nbd_config UAF: 1) grab nbd_config temporarily; 2) nbd_genl_disconnect() flush all recv_work() and release the initial reference: nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero 3) nbd_genl_reconfigure() queue recv_work() again; nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work) 4) step 1) release the reference; 5) Finially, recv_work() will trigger UAF: recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail.

27 Feb 2025, 18:15

Type Values Removed Values Added
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

27 Feb 2025, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 02:15

Updated : 2025-03-24 18:56

NVD link : CVE-2025-21731

Mitre link : CVE-2025-21731

CVE.ORG link : CVE-2025-21731

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free