CVE-2025-21638 (GCVE-0-2025-21638)
Vulnerability from cvelistv5
Published
2025-01-19 10:17
Modified
2026-08-05 11:53
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns. - current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2). The 'net' structure can be obtained from the table->data using container_of(). Note that table->data could also be used directly, but that would increase the size of this fix, while 'sctp.ctl_sock' still needs to be retrieved from 'net' structure.
References
Impacted products
Vendor Product Version
Linux Linux Version: b14878ccb7fac0242db82720b784ab62c467c0dc
Version: b14878ccb7fac0242db82720b784ab62c467c0dc
Version: b14878ccb7fac0242db82720b784ab62c467c0dc
Version: b14878ccb7fac0242db82720b784ab62c467c0dc
Version: b14878ccb7fac0242db82720b784ab62c467c0dc
Version: b14878ccb7fac0242db82720b784ab62c467c0dc
Version: b14878ccb7fac0242db82720b784ab62c467c0dc
Version: e5eae4a0511241959498b180fa0df0d4f1b11b9c
Version: 88830f227a1f96e44d82ddfcb0cc81d517ec6dd8
Version: 3938b0336a93fa5faa242dc9e5823ac69df9e066
Version: 3.10.41   ≤
Version: 3.12.21   ≤
Version: 3.14.5   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:58:17.877Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:02:58.938Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf387cdebfaebae228dfba162f94c567a67610c3",
              "status": "affected",
              "version": "b14878ccb7fac0242db82720b784ab62c467c0dc",
              "versionType": "git"
            },
            {
              "lessThan": "dc583e7e5f8515ca489c0df28e4362a70eade382",
              "status": "affected",
              "version": "b14878ccb7fac0242db82720b784ab62c467c0dc",
              "versionType": "git"
            },
            {
              "lessThan": "bd2a2939423566c654545fa3e96a656662a0af9e",
              "status": "affected",
              "version": "b14878ccb7fac0242db82720b784ab62c467c0dc",
              "versionType": "git"
            },
            {
              "lessThan": "1b67030d39f2b00f94ac1f0af11ba6657589e4d3",
              "status": "affected",
              "version": "b14878ccb7fac0242db82720b784ab62c467c0dc",
              "versionType": "git"
            },
            {
              "lessThan": "7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6",
              "status": "affected",
              "version": "b14878ccb7fac0242db82720b784ab62c467c0dc",
              "versionType": "git"
            },
            {
              "lessThan": "c184bc621e3cef03ac9ba81a50dda2dae6a21d36",
              "status": "affected",
              "version": "b14878ccb7fac0242db82720b784ab62c467c0dc",
              "versionType": "git"
            },
            {
              "lessThan": "15649fd5415eda664ef35780c2013adeb5d9c695",
              "status": "affected",
              "version": "b14878ccb7fac0242db82720b784ab62c467c0dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e5eae4a0511241959498b180fa0df0d4f1b11b9c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "88830f227a1f96e44d82ddfcb0cc81d517ec6dd8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3938b0336a93fa5faa242dc9e5823ac69df9e066",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.41",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.21",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.234",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.177",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.125",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.72",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.41",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: sysctl: auth_enable: avoid using current-\u003ensproxy\n\nAs mentioned in a previous commit of this series, using the \u0027net\u0027\nstructure via \u0027current\u0027 is not recommended for different reasons:\n\n- Inconsistency: getting info from the reader\u0027s/writer\u0027s netns vs only\n  from the opener\u0027s netns.\n\n- current-\u003ensproxy can be NULL in some cases, resulting in an \u0027Oops\u0027\n  (null-ptr-deref), e.g. when the current task is exiting, as spotted by\n  syzbot [1] using acct(2).\n\nThe \u0027net\u0027 structure can be obtained from the table-\u003edata using\ncontainer_of().\n\nNote that table-\u003edata could also be used directly, but that would\nincrease the size of this fix, while \u0027sctp.ctl_sock\u0027 still needs to be\nretrieved from \u0027net\u0027 structure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Despite living in net/sctp/, `proc_sctp_do_auth()` is a procfs sysctl -\u003eproc_handler that no received SCTP packet, socket, or association path ever invokes; it is reached only through local file I/O on /proc/sys/net/sctp/auth_enable and local syscalls (write(2), acct(2)).\nAC:L - Both trigger paths are fully deterministic and entirely attacker-scripted \u2014 unshare/open/SCM_RIGHTS/write for the netns-confusion path, or acct(2) plus lazy umount plus process exit for the NULL deref \u2014 with no race, no victim state, and no memory-layout dependency.\nPR:L - An unprivileged local user reaches the flaw via unprivileged user namespaces (default-enabled on Ubuntu/Debian/Fedora/Android), since cap_capable() grants the owner of a child user namespace CAP_NET_ADMIN over it (security/commoncap.c:92), letting a process still in the init netns write through the child\u0027s sysctl fd and have the handler act on init_net; only the secondary acct(2) oops path additionally needs CAP_SYS_PACCT.\nUI:N - The attacker performs every step from its own cooperating processes \u2014 namespace creation, fd passing, the write, or acct(2) and its own exit \u2014 with no action required from any other user or administrator.\nS:U - The flawed code and the affected resources are both kernel network-namespace state under the same kernel security authority; per kernel CNA convention namespace boundary crossings inside the kernel are scored Unchanged, and no hypervisor, IOMMU, or VM boundary is involved.\nC:N - The NULL+0x28 dereference faults before any data is returned to userspace, and the read side of the netns confusion only reports the caller\u0027s own netns value for a world-readable (0644) setting, so no protected information is disclosed.\nI:H - The netns confusion lets an unprivileged local user write init_net.sctp.auth_enable and directly mutate the host control socket\u0027s endpoint (sctp_sk(net-\u003esctp.ctl_sock)-\u003eep-\u003eauth_enable); clearing it makes every newly created host endpoint skip sctp_auth_init() and stop negotiating RFC 4895 AUTH, disabling SCTP chunk authentication host-wide \u2014 an attacker-chosen modification of protected host state and a bypass of a security control.\nA:H - The NULL-ptr-deref oopses inside do_exit() after exit_task_namespaces() while acct-\u003elock is held under mnt_pin_kill(), wedging the task mid-teardown with a permanently held mutex and pinned mount, and panicking outright on the panic_on_oops builds common in embedded, automotive, and hardened deployments."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:18.276Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cf387cdebfaebae228dfba162f94c567a67610c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc583e7e5f8515ca489c0df28e4362a70eade382"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd2a2939423566c654545fa3e96a656662a0af9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b67030d39f2b00f94ac1f0af11ba6657589e4d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ec30c54f339c640aa7e49d7e9f7bbed6bd42bf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c184bc621e3cef03ac9ba81a50dda2dae6a21d36"
        },
        {
          "url": "https://git.kernel.org/stable/c/15649fd5415eda664ef35780c2013adeb5d9c695"
        }
      ],
      "title": "sctp: sysctl: auth_enable: avoid using current-\u003ensproxy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21638",
    "datePublished": "2025-01-19T10:17:56.084Z",
    "dateReserved": "2024-12-29T08:45:45.727Z",
    "dateUpdated": "2026-08-05T11:53:18.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.