CVE-2025-21811

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21811
In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references nilfs_lookup_dirty_data_buffers(), which iterates through the buffers attached to dirty data folios/pages, accesses the attached buffers without locking the folios/pages. For data cache, nilfs_clear_folio_dirty() may be called asynchronously when the file system degenerates to read only, so nilfs_lookup_dirty_data_buffers() still has the potential to cause use after free issues when buffers lose the protection of their dirty state midway due to this asynchronous clearing and are unintentionally freed by try_to_free_buffers(). Eliminate this race issue by adjusting the lock section in this function.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/367a9bffabe08c04f6d725032cce3d891b2b9e1a Patch
https://git.kernel.org/stable/c/4b08d23d7d1917bef4fbee8ad81372f49b006656 Patch
https://git.kernel.org/stable/c/58c27fa7a610b6e8d44e6220e7dbddfbaccaf439 Patch
https://git.kernel.org/stable/c/72cf688d0ce7e642b12ddc9b2a42524737ec1b4a Patch
https://git.kernel.org/stable/c/8e1b9201c9a24638cf09c6e1c9f224157328010b Patch
https://git.kernel.org/stable/c/c437dfac9f7a5a46ac2a5e6d6acd3059e9f68188 Patch
https://git.kernel.org/stable/c/d8ff250e085a4c4cdda4ad1cdd234ed110393143 Patch
https://git.kernel.org/stable/c/e1fc4a90a90ea8514246c45435662531975937d9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Mar 2025, 18:30

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/367a9bffabe08c04f6d725032cce3d891b2b9e1a - () https://git.kernel.org/stable/c/367a9bffabe08c04f6d725032cce3d891b2b9e1a - Patch
References () https://git.kernel.org/stable/c/4b08d23d7d1917bef4fbee8ad81372f49b006656 - () https://git.kernel.org/stable/c/4b08d23d7d1917bef4fbee8ad81372f49b006656 - Patch
References () https://git.kernel.org/stable/c/58c27fa7a610b6e8d44e6220e7dbddfbaccaf439 - () https://git.kernel.org/stable/c/58c27fa7a610b6e8d44e6220e7dbddfbaccaf439 - Patch
References () https://git.kernel.org/stable/c/72cf688d0ce7e642b12ddc9b2a42524737ec1b4a - () https://git.kernel.org/stable/c/72cf688d0ce7e642b12ddc9b2a42524737ec1b4a - Patch
References () https://git.kernel.org/stable/c/8e1b9201c9a24638cf09c6e1c9f224157328010b - () https://git.kernel.org/stable/c/8e1b9201c9a24638cf09c6e1c9f224157328010b - Patch
References () https://git.kernel.org/stable/c/c437dfac9f7a5a46ac2a5e6d6acd3059e9f68188 - () https://git.kernel.org/stable/c/c437dfac9f7a5a46ac2a5e6d6acd3059e9f68188 - Patch
References () https://git.kernel.org/stable/c/d8ff250e085a4c4cdda4ad1cdd234ed110393143 - () https://git.kernel.org/stable/c/d8ff250e085a4c4cdda4ad1cdd234ed110393143 - Patch
References () https://git.kernel.org/stable/c/e1fc4a90a90ea8514246c45435662531975937d9 - () https://git.kernel.org/stable/c/e1fc4a90a90ea8514246c45435662531975937d9 - Patch

13 Mar 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/72cf688d0ce7e642b12ddc9b2a42524737ec1b4a -
  • () https://git.kernel.org/stable/c/d8ff250e085a4c4cdda4ad1cdd234ed110393143 -
  • () https://git.kernel.org/stable/c/e1fc4a90a90ea8514246c45435662531975937d9 -

04 Mar 2025, 18:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: protege el acceso a los búferes sin referencias activas nilfs_lookup_dirty_data_búferes(), que itera a través de los búferes adjuntos a los folios/páginas de datos sucios, accede a los búferes adjuntos sin bloquear los folios/páginas. Para el caché de datos, nilfs_clear_folio_dirty() puede llamarse de forma asincrónica cuando el sistema de archivos se degenera a solo lectura, por lo que nilfs_lookup_dirty_data_búferes() aún tiene el potencial de causar problemas de use after free cuando los búferes pierden la protección de su estado sucio a mitad de camino debido a esta limpieza asincrónica y son liberados involuntariamente por try_to_free_búferes(). Elimine este problema de ejecución ajustando la sección de bloqueo en esta función.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

27 Feb 2025, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 20:16

Updated : 2025-03-21 18:30

NVD link : CVE-2025-21811

Mitre link : CVE-2025-21811

CVE.ORG link : CVE-2025-21811

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free