CVE-2025-22072

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22072
In the Linux kernel, the following vulnerability has been resolved: spufs: fix gang directory lifetimes prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have a problem with gang lifetimes - creation of a gang returns opened gang directory, which normally gets removed when that gets closed, but if somebody has created a context belonging to that gang and kept it alive until the gang got closed, removal failed and we ended up with a leak. Unfortunately, it had been fixed the wrong way. Dentry of gang directory was no longer pinned, and rmdir on close was gone. One problem was that failure of open kept calling simple_rmdir() as cleanup, which meant an unbalanced dput(). Another bug was in the success case - gang creation incremented link count on root directory, but that was no longer undone when gang got destroyed. Fix consists of * reverting the commit in question * adding a counter to gang, protected by ->i_rwsem of gang directory inode. * having it set to 1 at creation time, dropped in both spufs_dir_close() and spufs_gang_close() and bumped in spufs_create_context(), provided that it's not 0. * using simple_recursive_removal() to take the gang directory out when counter reaches zero.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/029d8c711f5e5fe8cf63e8a4a1a140a06e224e45 Patch
https://git.kernel.org/stable/c/324f280806aab28ef757aecc18df419676c10ef8 Patch
https://git.kernel.org/stable/c/880e7b3da2e765c1f90c94c0539be039e96c7062 Patch
https://git.kernel.org/stable/c/903733782f3ae28a2f7fe4dfb47c7fe3e079a528 Patch
https://git.kernel.org/stable/c/c134deabf4784e155d360744d4a6a835b9de4dd4 Patch
https://git.kernel.org/stable/c/fc646a6c6d14b5d581f162a7e32999f789e3a3ac Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22:rc7:*:*:*:*:*:*
History

31 Oct 2025, 20:49

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/029d8c711f5e5fe8cf63e8a4a1a140a06e224e45 - () https://git.kernel.org/stable/c/029d8c711f5e5fe8cf63e8a4a1a140a06e224e45 - Patch
References () https://git.kernel.org/stable/c/324f280806aab28ef757aecc18df419676c10ef8 - () https://git.kernel.org/stable/c/324f280806aab28ef757aecc18df419676c10ef8 - Patch
References () https://git.kernel.org/stable/c/880e7b3da2e765c1f90c94c0539be039e96c7062 - () https://git.kernel.org/stable/c/880e7b3da2e765c1f90c94c0539be039e96c7062 - Patch
References () https://git.kernel.org/stable/c/903733782f3ae28a2f7fe4dfb47c7fe3e079a528 - () https://git.kernel.org/stable/c/903733782f3ae28a2f7fe4dfb47c7fe3e079a528 - Patch
References () https://git.kernel.org/stable/c/c134deabf4784e155d360744d4a6a835b9de4dd4 - () https://git.kernel.org/stable/c/c134deabf4784e155d360744d4a6a835b9de4dd4 - Patch
References () https://git.kernel.org/stable/c/fc646a6c6d14b5d581f162a7e32999f789e3a3ac - () https://git.kernel.org/stable/c/fc646a6c6d14b5d581f162a7e32999f789e3a3ac - Patch
CWE NVD-CWE-noinfo
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spufs: corrige la duración del directorio de pandillas. Antes de "[POWERPC] spufs: corrige las fugas de destrucción de pandillas", teníamos un problema con la duración de las pandillas: al crear una pandilla, se devolvía el directorio de pandillas abierto, que normalmente se elimina al cerrarse. Sin embargo, si alguien creaba un contexto perteneciente a esa pandilla y lo mantenía activo hasta que se cerraba, la eliminación fallaba y se producía una fuga. Desafortunadamente, se solucionó incorrectamente. La dentry del directorio de pandillas ya no estaba fijada y rmdir al cerrar se había eliminado. Un problema era que, al fallar la apertura, se seguía llamando a simple_rmdir() como limpieza, lo que implicaba un dput() desequilibrado. Otro error, en el caso de éxito, era que la creación de una pandilla incrementaba el número de enlaces en el directorio raíz, pero esto ya no se deshacía al destruirla. La solución consiste en: * revertir el commit en cuestión * añadir un contador a la pandilla, protegido por ->i_rwsem del inodo del directorio de pandillas. * tenerlo establecido en 1 en el momento de la creación, descartado tanto en spufs_dir_close() como en spufs_gang_close() y agregado en spufs_create_context(), siempre que no sea 0. * usar simple_recursive_removal() para sacar el directorio de pandillas cuando el contador llega a cero.
CPE cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.22:rc6:*:*:*:*:*:*

16 Apr 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 15:16

Updated : 2025-10-31 20:49

NVD link : CVE-2025-22072

Mitre link : CVE-2025-22072

CVE.ORG link : CVE-2025-22072

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo