CVE-2025-22027

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22027
In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even though it is checked for NULL in the same function, which means there is a race condition. It occurs due to the incorrect order of actions in the streamzap_disconnect() function: rc_unregister_device() is called before usb_kill_urb(). The dev->raw pointer is freed and set to NULL in rc_unregister_device(), and only after that usb_kill_urb() waits for in-progress requests to finish. If rc_unregister_device() is called while streamzap_callback() handler is not finished, this can lead to accessing freed resources. Thus rc_unregister_device() should be called after usb_kill_urb(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/15483afb930fc2f883702dc96f80efbe4055235e Patch
https://git.kernel.org/stable/c/30ef7cfee752ca318d5902cb67b60d9797ccd378 Patch
https://git.kernel.org/stable/c/4db62b60af2ccdea6ac5452fd20e29587ed85f57 Patch
https://git.kernel.org/stable/c/8760da4b9d44c36b93b6e4cf401ec7fe520015bd Patch
https://git.kernel.org/stable/c/adf0ddb914c9e5b3e50da4c97959e82de2df75c3 Patch
https://git.kernel.org/stable/c/e11652a6514ec805440c1bb3739e6c6236fffcc7 Patch
https://git.kernel.org/stable/c/f1d518c0bad01abe83c2df880274cb6a39f4a457 Patch
https://git.kernel.org/stable/c/f656cfbc7a293a039d6a0c7100e1c846845148c1 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

06 May 2025, 16:45

Type Values Removed Values Added
CWE CWE-362
CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/15483afb930fc2f883702dc96f80efbe4055235e - () https://git.kernel.org/stable/c/15483afb930fc2f883702dc96f80efbe4055235e - Patch
References () https://git.kernel.org/stable/c/30ef7cfee752ca318d5902cb67b60d9797ccd378 - () https://git.kernel.org/stable/c/30ef7cfee752ca318d5902cb67b60d9797ccd378 - Patch
References () https://git.kernel.org/stable/c/4db62b60af2ccdea6ac5452fd20e29587ed85f57 - () https://git.kernel.org/stable/c/4db62b60af2ccdea6ac5452fd20e29587ed85f57 - Patch
References () https://git.kernel.org/stable/c/8760da4b9d44c36b93b6e4cf401ec7fe520015bd - () https://git.kernel.org/stable/c/8760da4b9d44c36b93b6e4cf401ec7fe520015bd - Patch
References () https://git.kernel.org/stable/c/adf0ddb914c9e5b3e50da4c97959e82de2df75c3 - () https://git.kernel.org/stable/c/adf0ddb914c9e5b3e50da4c97959e82de2df75c3 - Patch
References () https://git.kernel.org/stable/c/e11652a6514ec805440c1bb3739e6c6236fffcc7 - () https://git.kernel.org/stable/c/e11652a6514ec805440c1bb3739e6c6236fffcc7 - Patch
References () https://git.kernel.org/stable/c/f1d518c0bad01abe83c2df880274cb6a39f4a457 - () https://git.kernel.org/stable/c/f1d518c0bad01abe83c2df880274cb6a39f4a457 - Patch
References () https://git.kernel.org/stable/c/f656cfbc7a293a039d6a0c7100e1c846845148c1 - () https://git.kernel.org/stable/c/f656cfbc7a293a039d6a0c7100e1c846845148c1 - Patch

02 May 2025, 07:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: streamzap: fix race between device disconnection and urb callback Syzkaller ha informado de un fallo de protección general en la función ir_raw_event_store_with_filter(). Este fallo se debe a una desreferencia del puntero NULL del puntero dev->raw, aunque se comprueba si es NULL en la misma función, lo que significa que hay una condición de ejecución. Se produce debido al orden incorrecto de acciones en la función streamzap_disconnect(): se llama a rc_unregister_device() antes de usb_kill_urb(). El puntero dev->raw se libera y se establece en NULL en rc_unregister_device(), y solo después de eso, usb_kill_urb() espera a que finalicen las solicitudes en curso. Si se llama a rc_unregister_device() mientras el controlador streamzap_callback() no ha finalizado, esto puede provocar el acceso a los recursos liberados. Por lo tanto, rc_unregister_device() debe llamarse después de usb_kill_urb(). Encontrado por el Centro de Verificación de Linux (linuxtesting.org) con Syzkaller.
References
  • () https://git.kernel.org/stable/c/e11652a6514ec805440c1bb3739e6c6236fffcc7 -
  • () https://git.kernel.org/stable/c/f1d518c0bad01abe83c2df880274cb6a39f4a457 -

16 Apr 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 15:15

Updated : 2025-05-06 16:45

NVD link : CVE-2025-22027

Mitre link : CVE-2025-22027

CVE.ORG link : CVE-2025-22027

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-476

NULL Pointer Dereference