CVE-2025-37799

{"id": "CVE-2025-37799", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-05-03T12:15:14.950", "references": [{"url": "https://git.kernel.org/stable/c/33e131a10459d16f181c8184d3f17f1c318c7002", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4c2227656d9003f4d77afc76f34dd81b95e4c2c4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c4312c4d244aa58e811ff0297e013124d115e793", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e3ad76e36a37b0ff4a71b06d5b33530ee8c3a177", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp\n\nvmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that\nis, packet sizes between 128 - 3k bytes).\n\nWe noticed MTU-related connectivity issues with Cilium's service load-\nbalancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP\nbackend service where the XDP LB was doing IPIP encap led to overly large\npacket sizes but only for *some* of the packets (e.g. HTTP GET request)\nwhile others (e.g. the prior TCP 3WHS) looked completely fine on the wire.\n\nIn fact, the pcap recording on the backend node actually revealed that the\nnode with the XDP LB was leaking uninitialized kernel data onto the wire\nfor the affected packets, for example, while the packets should have been\n152 bytes their actual size was 1482 bytes, so the remainder after 152 bytes\nwas padded with whatever other data was in that page at the time (e.g. we\nsaw user/payload data from prior processed packets).\n\nWe only noticed this through an MTU issue, e.g. when the XDP LB node and\nthe backend node both had the same MTU (e.g. 1500) then the curl request\ngot dropped on the backend node's NIC given the packet was too large even\nthough the IPIP-encapped packet normally would never even come close to\nthe MTU limit. Lowering the MTU on the XDP LB (e.g. 1480) allowed to let\nthe curl request succeed (which also indicates that the kernel ignored the\npadding, and thus the issue wasn't very user-visible).\n\nCommit e127ce7699c1 (\"vmxnet3: Fix missing reserved tailroom\") was too eager\nto also switch xdp_prepare_buff() from rcd->len to rbi->len. It really needs\nto stick to rcd->len which is the actual packet length from the descriptor.\nThe latter we also feed into vmxnet3_process_xdp_small(), by the way, and\nit indicates the correct length needed to initialize the xdp->{data,data_end}\nparts. For e127ce7699c1 (\"vmxnet3: Fix missing reserved tailroom\") the\nrelevant part was adapting xdp_init_buff() to address the warning given the\nxdp_data_hard_end() depends on xdp->frame_sz. With that fixed, traffic on\nthe wire looks good again."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vmxnet3: Se ha corregido un tama\u00f1o de paquete incorrecto en vmxnet3_process_xdp. El manejo de XDP del controlador vmxnet3 presenta errores para tama\u00f1os de paquete que utilizan ring0 (es decir, tama\u00f1os de paquete entre 128 y 3 k bytes). Observamos problemas de conectividad relacionados con la MTU con el balanceo de carga del servicio de Cilium en el caso de vmxnet3 como NIC subyacente. Una simple conexi\u00f3n curl a un servicio HTTP backend donde el LB XDP realizaba encapsulado IPIP gener\u00f3 tama\u00f1os de paquete excesivamente grandes, pero solo para *algunos* paquetes (p. ej., una solicitud HTTP GET), mientras que otros (p. ej., el TCP 3WHS anterior) funcionaron correctamente en la red. De hecho, la grabaci\u00f3n de pcap en el nodo backend revel\u00f3 que el nodo con el LB XDP estaba filtrando datos de kernel sin inicializar en la red para los paquetes afectados. Por ejemplo, si bien los paquetes deber\u00edan haber tenido 152 bytes, su tama\u00f1o real era de 1482 bytes, por lo que el resto despu\u00e9s de 152 bytes se rellen\u00f3 con cualquier otro dato que hubiera en esa p\u00e1gina en ese momento (por ejemplo, vimos datos de usuario/carga \u00fatil de paquetes procesados previamente). Solo notamos esto a trav\u00e9s de un problema de MTU; por ejemplo, cuando el nodo LB XDP y el nodo backend ten\u00edan la misma MTU (por ejemplo, 1500), la solicitud curl se descart\u00f3 en la NIC del nodo backend debido a que el paquete era demasiado grande, aunque el paquete encapsulado en IPIP normalmente ni siquiera se acercar\u00eda al l\u00edmite de MTU. Reducir la MTU en el LB XDP (por ejemplo, 1480) permiti\u00f3 que la solicitud curl se ejecutara correctamente (lo que tambi\u00e9n indica que el kernel ignor\u00f3 el relleno y, por lo tanto, el problema no era muy visible para el usuario). el commit e127ce7699c1 (\"vmxnet3: Correcci\u00f3n de la falta de espacio reservado para la cola\") estaba demasiado ansiosa por cambiar xdp_prepare_buff() de rcd->len a rbi->len. Es necesario que se mantenga en rcd->len, que es la longitud real del paquete del descriptor. Por cierto, esta \u00faltima tambi\u00e9n se introduce en vmxnet3_process_xdp_small(), e indica la longitud correcta necesaria para inicializar las partes xdp->{data,data_end}. Para e127ce7699c1 (\"vmxnet3: Correcci\u00f3n de la falta de espacio reservado para la cola\"), la parte relevante fue adaptar xdp_init_buff() para abordar la advertencia, dado que xdp_data_hard_end() depende de xdp->frame_sz. Con esto corregido, el tr\u00e1fico en la red se ve bien de nuevo."}], "lastModified": "2025-11-10T17:36:25.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5319475-3C8E-45DC-829D-B2938A18F5B3", "versionEndExcluding": "6.6.89", "versionStartIncluding": "6.6.23"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD8383BB-B294-4F4D-996D-A780685E6362", "versionEndExcluding": "6.8", "versionStartIncluding": "6.7.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38B53269-FE69-4FBE-B4C5-BB979A82CBD7", "versionEndExcluding": "6.12.26", "versionStartIncluding": "6.8.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B25CA7E-4CD0-46DB-B4EF-13A3516071FB", "versionEndExcluding": "6.14.5", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}