CVE-2025-38089 (GCVE-0-2025-38089)
Vulnerability from cvelistv5
Published
2025-06-30 07:29
Modified
2026-08-05 11:59
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a way that SVC_GARBAGE is returned without setting the rq_accept_statp pointer, then that pointer can be dereferenced and a value stored there. If it's the first time the thread has processed an RPC, then that pointer will be set to NULL and the kernel will crash. In other cases, it could create a memory scribble. The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531 says that if authentication fails that the RPC should be rejected instead with a status of AUTH_ERR. Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This sidesteps the whole problem of touching the rpc_accept_statp pointer in this situation and avoids the crash.
Impacted products
Vendor Product Version
Linux Linux Version: 29cd2927fb914cc53b5ba4f67d2b74695c994ba4
Version: 29cd2927fb914cc53b5ba4f67d2b74695c994ba4
Version: 29cd2927fb914cc53b5ba4f67d2b74695c994ba4
Version: 29cd2927fb914cc53b5ba4f67d2b74695c994ba4
Version: 9b59f5c4911e87264507e0934cd2bb277390c560
Version: 6.3.4   
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:10:10.064Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/02/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "599c489eea793821232a2f69a00fa57d82b0ac98",
              "status": "affected",
              "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4",
              "versionType": "git"
            },
            {
              "lessThan": "353e75b55e583635bf71cde6abcec274dba05edd",
              "status": "affected",
              "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4",
              "versionType": "git"
            },
            {
              "lessThan": "c90459cd58bb421d275337093d8e901e0ba748dd",
              "status": "affected",
              "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4",
              "versionType": "git"
            },
            {
              "lessThan": "94d10a4dba0bc482f2b01e39f06d5513d0f75742",
              "status": "affected",
              "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b59f5c4911e87264507e0934cd2bb277390c560",
              "versionType": "git"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/svc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: handle SVC_GARBAGE during svc auth processing as auth error\n\ntianshuo han reported a remotely-triggerable crash if the client sends a\nkernel RPC server a specially crafted packet. If decoding the RPC reply\nfails in such a way that SVC_GARBAGE is returned without setting the\nrq_accept_statp pointer, then that pointer can be dereferenced and a\nvalue stored there.\n\nIf it\u0027s the first time the thread has processed an RPC, then that\npointer will be set to NULL and the kernel will crash. In other cases,\nit could create a memory scribble.\n\nThe server sunrpc code treats a SVC_GARBAGE return from svc_authenticate\nor pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531\nsays that if authentication fails that the RPC should be rejected\ninstead with a status of AUTH_ERR.\n\nHandle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of\nAUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This\nsidesteps the whole problem of touching the rpc_accept_statp pointer in\nthis situation and avoids the crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the shared kernel RPC server core (net/sunrpc/svc.c) used by nfsd, lockd, and the NFS callback service, and is triggered purely by the bytes of an inbound RPC call arriving on TCP/UDP 2049. Any host that can reach the listening socket, including across the internet, can send the malformed record.\nAC:L - The attacker sends a single truncated RPC message that ends before the credential flavor field; decode failure and the bad store are deterministic, with no race and no memory-layout precondition. Fresh nfsd threads (server start or pool growth) give the NULL-pointer variant reliably, and every other thread yields the write-after-free variant.\nPR:N - The crash occurs inside svc_authenticate() itself, before any credential is decoded and long before svc_set_client()/export checks, so no RPC credential, mount, or account is needed. A bare TCP connect to the RPC port is sufficient.\nUI:N - The server processes the malformed RPC automatically on receipt. No action by any local user or administrator is involved.\nS:U - The faulting store and its consequences are confined to the kernel\u0027s own memory and the RPC service; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - In the stale-pointer case this is a write into a freed and reallocated page, i.e. memory corruption of arbitrary kernel objects that can be groomed into that slot; corrupting a length or index field in a neighboring structure yields subsequent over-reads and disclosure of kernel memory.\nI:H - The vulnerable store writes a 32-bit value into a page that has already been released to the allocator and may hold any kernel object, at an offset the attacker can influence via the previous reply\u0027s verifier length. That is a remote pre-auth write-after-free primitive usable to corrupt pointers, credentials, or control data.\nA:H - The NULL-pointer variant oopses the nfsd kernel thread on the very first malformed RPC a thread sees, and can be repeated to kill the whole thread pool, taking down NFS service entirely (full panic where panic_on_oops is set). The write-after-free variant additionally causes unpredictable crashes in unrelated subsystems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:25.591Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/599c489eea793821232a2f69a00fa57d82b0ac98"
        },
        {
          "url": "https://git.kernel.org/stable/c/353e75b55e583635bf71cde6abcec274dba05edd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c90459cd58bb421d275337093d8e901e0ba748dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/94d10a4dba0bc482f2b01e39f06d5513d0f75742"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2025/07/02/2"
        },
        {
          "url": "https://github.com/keymaker-arch/NFSundown"
        }
      ],
      "title": "sunrpc: handle SVC_GARBAGE during svc auth processing as auth error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38089",
    "datePublished": "2025-06-30T07:29:44.836Z",
    "dateReserved": "2025-04-16T04:51:23.982Z",
    "dateUpdated": "2026-08-05T11:59:25.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…