CVE-2025-22033

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22033
In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in do_compat_alignment_fixup() do_alignment_t32_to_handler() only fixes up alignment faults for specific instructions; it returns NULL otherwise (e.g. LDREX). When that's the case, signal to the caller that it needs to proceed with the regular alignment fault handling (i.e. SIGBUS). Without this patch, the kernel panics: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000006 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=00000800164aa000 [0000000000000000] pgd=0800081fdbd22003, p4d=0800081fdbd22003, pud=08000815d51c6003, pmd=0000000000000000 Internal error: Oops: 0000000086000006 [#1] SMP Modules linked in: cfg80211 rfkill xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter veth nvme_fa> libcrc32c crc32c_generic raid0 multipath linear dm_mod dax raid1 md_mod xhci_pci nvme xhci_hcd nvme_core t10_pi usbcore igb crc64_rocksoft crc64 crc_t10dif crct10dif_generic crct10dif_ce crct10dif_common usb_common i2c_algo_bit i2c> CPU: 2 PID: 3932954 Comm: WPEWebProcess Not tainted 6.1.0-31-arm64 #1 Debian 6.1.128-1 Hardware name: GIGABYTE MP32-AR1-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : 0x0 lr : do_compat_alignment_fixup+0xd8/0x3dc sp : ffff80000f973dd0 x29: ffff80000f973dd0 x28: ffff081b42526180 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000004 x22: 0000000000000000 x21: 0000000000000001 x20: 00000000e8551f00 x19: ffff80000f973eb0 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffaebc949bc488 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000400000 x4 : 0000fffffffffffe x3 : 0000000000000000 x2 : ffff80000f973eb0 x1 : 00000000e8551f00 x0 : 0000000000000001 Call trace: 0x0 do_alignment_fault+0x40/0x50 do_mem_abort+0x4c/0xa0 el0_da+0x48/0xf0 el0t_32_sync_handler+0x110/0x140 el0t_32_sync+0x190/0x194 Code: bad PC value ---[ end trace 0000000000000000 ]---

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2df8ee605eb6806cd41c2095306db05206633a08 Patch
https://git.kernel.org/stable/c/617a4b0084a547917669fef2b54253cc9c064990 Patch
https://git.kernel.org/stable/c/c28f31deeacda307acfee2f18c0ad904e5123aac Patch
https://git.kernel.org/stable/c/cf187601053ecaf671ae645edb898901f81d03e9 Patch
https://git.kernel.org/stable/c/ecf798573bbe0805803f7764e12a34b4bcc65074 Patch
https://git.kernel.org/stable/c/fa2a9f625f185c6acb4ee5be8d71359a567afac9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

29 Apr 2025, 18:57

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/2df8ee605eb6806cd41c2095306db05206633a08 - () https://git.kernel.org/stable/c/2df8ee605eb6806cd41c2095306db05206633a08 - Patch
References () https://git.kernel.org/stable/c/617a4b0084a547917669fef2b54253cc9c064990 - () https://git.kernel.org/stable/c/617a4b0084a547917669fef2b54253cc9c064990 - Patch
References () https://git.kernel.org/stable/c/c28f31deeacda307acfee2f18c0ad904e5123aac - () https://git.kernel.org/stable/c/c28f31deeacda307acfee2f18c0ad904e5123aac - Patch
References () https://git.kernel.org/stable/c/cf187601053ecaf671ae645edb898901f81d03e9 - () https://git.kernel.org/stable/c/cf187601053ecaf671ae645edb898901f81d03e9 - Patch
References () https://git.kernel.org/stable/c/ecf798573bbe0805803f7764e12a34b4bcc65074 - () https://git.kernel.org/stable/c/ecf798573bbe0805803f7764e12a34b4bcc65074 - Patch
References () https://git.kernel.org/stable/c/fa2a9f625f185c6acb4ee5be8d71359a567afac9 - () https://git.kernel.org/stable/c/fa2a9f625f185c6acb4ee5be8d71359a567afac9 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: No llamar a NULL en do_compat_alignment_fixup(). do_alignment_t32_to_handler() solo corrige errores de alineación para instrucciones específicas; devuelve NULL en caso contrario (por ejemplo, LDREX). En ese caso, se indica al emisor que debe continuar con la gestión normal de errores de alineación (por ejemplo, SIGBUS). Sin este parche, el kernel entra en pánico: No se puede gestionar la desreferencia del puntero NULL del kernel en la dirección virtual 0000000000000000 Información de aborto de memoria: ESR = 0x0000000086000006 EC = 0x21: IABT (EL actual), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: error de traducción de nivel 2 usuario pgtable: 4k páginas, VAs de 48 bits, pgdp=00000800164aa000 [000000000000000] pgd=0800081fdbd22003, p4d=0800081fdbd22003, pud=08000815d51c6003, pmd=0000000000000000 Error interno: Ups: 0000000086000006 [#1] Módulos SMP vinculados en: cfg80211 rfkill xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter veth nvme_fa> libcrc32c crc32c_generic raid0 multipath lineal dm_mod dax raid1 md_mod xhci_pci nvme xhci_hcd nvme_core t10_pi usbcore igb crc64_rocksoft crc64 crc_t10dif crct10dif_generic crct10dif_ce crct10dif_common usb_common i2c_algo_bit i2c> CPU: 2 PID: 3932954 Comm: WPEWebProcess No contaminado 6.1.0-31-arm64 #1 Debian 6.1.128-1 Nombre del hardware: GIGABYTE MP32-AR1-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : 0x0 lr: corregir la alineación de compatibilidad+0xd8/0x3dc sp: ffff80000f973dd0 x29: ffff80000f973dd0 x28: ffff081b42526180 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000004 x22: 0000000000000000 x21: 0000000000000001 x20: 00000000e8551f00 x19: ffff80000f973eb0 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 000000000000000 x9: ffffaebc949bc488 x8: 000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 00000000000400000 x4 : 0000ffffffffffffe x3 : 0000000000000000 x2 : ffff80000f973eb0 x1 : 00000000e8551f00 x0 : 0000000000000001 Rastreo de llamadas: 0x0 do_alignment_fault+0x40/0x50 do_mem_abort+0x4c/0xa0 el0_da+0x48/0xf0 el0t_32_sync_handler+0x110/0x140 el0t_32_sync+0x190/0x194 Código: valor de PC incorrecto ---[ fin de seguimiento 0000000000000000 ]---
First Time Linux linux Kernel
Linux
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

16 Apr 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 15:15

Updated : 2025-04-29 18:57

NVD link : CVE-2025-22033

Mitre link : CVE-2025-22033

CVE.ORG link : CVE-2025-22033

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference