CVE-2025-22048

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22048
In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Don't override subprog's return value The verifier test `calls: div by 0 in subprog` triggers a panic at the ld.bu instruction. The ld.bu insn is trying to load byte from memory address returned by the subprog. The subprog actually set the correct address at the a5 register (dedicated register for BPF return values). But at commit 73c359d1d356 ("LoongArch: BPF: Sign-extend return values") we also sign extended a5 to the a0 register (return value in LoongArch). For function call insn, we later propagate the a0 register back to a5 register. This is right for native calls but wrong for bpf2bpf calls which expect zero-extended return value in a5 register. So only move a0 to a5 for native calls (i.e. non-BPF_PSEUDO_CALL).

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/223d565d8892481684091cfbaf3466f2b0e289d3 Patch
https://git.kernel.org/stable/c/60f3caff1492e5b8616b9578c4bedb5c0a88ed14 Patch
https://git.kernel.org/stable/c/780628a780b622759d9e5adc76d15432144da1a3 Patch
https://git.kernel.org/stable/c/7df2696256a034405d3c5a71b3a4c54725de4404 Patch
https://git.kernel.org/stable/c/996e90ab446641553e8e21707b38b9709605e0e0 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

31 Oct 2025, 20:20

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/223d565d8892481684091cfbaf3466f2b0e289d3 - () https://git.kernel.org/stable/c/223d565d8892481684091cfbaf3466f2b0e289d3 - Patch
References () https://git.kernel.org/stable/c/60f3caff1492e5b8616b9578c4bedb5c0a88ed14 - () https://git.kernel.org/stable/c/60f3caff1492e5b8616b9578c4bedb5c0a88ed14 - Patch
References () https://git.kernel.org/stable/c/780628a780b622759d9e5adc76d15432144da1a3 - () https://git.kernel.org/stable/c/780628a780b622759d9e5adc76d15432144da1a3 - Patch
References () https://git.kernel.org/stable/c/7df2696256a034405d3c5a71b3a4c54725de4404 - () https://git.kernel.org/stable/c/7df2696256a034405d3c5a71b3a4c54725de4404 - Patch
References () https://git.kernel.org/stable/c/996e90ab446641553e8e21707b38b9709605e0e0 - () https://git.kernel.org/stable/c/996e90ab446641553e8e21707b38b9709605e0e0 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: LoongArch: BPF: No anule el valor de retorno del subprograma La prueba del verificador `calls: div by 0 in subprog` desencadena un pánico en la instrucción ld.bu. La instrucción ld.bu insn intenta cargar un byte desde la dirección de memoria devuelta por el subprograma. El subprograma en realidad estableció la dirección correcta en el registro a5 (registro dedicado para valores de retorno de BPF). Pero en el commit 73c359d1d356 ("LoongArch: BPF: Valores de retorno con signo extendido") también firmamos a5 extendido en el registro a0 (valor de retorno en LoongArch). Para la instrucción de llamada a función insn, luego propagamos el registro a0 de vuelta al registro a5. Esto es correcto para llamadas nativas, pero incorrecto para llamadas bpf2bpf que esperan un valor de retorno extendido cero en el registro a5. Por lo tanto, solo mueva a0 a a5 para llamadas nativas (es decir, no BPF_PSEUDO_CALL).
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo

16 Apr 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 15:15

Updated : 2025-10-31 20:20

NVD link : CVE-2025-22048

Mitre link : CVE-2025-22048

CVE.ORG link : CVE-2025-22048

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo