linux-cve-announce - CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025011946-CVE-2025-21648-bcda@gregkh>
Date: Sun, 19 Jan 2025 11:17:57 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it
is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when
resizing hashtable because __GFP_NOWARN is unset. See:

  0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")

Note: hashtable resize is only possible from init_netns.

The Linux kernel CVE team has assigned CVE-2025-21648 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.7 with commit 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 and fixed in 6.1.125 with commit 5552b4fd44be3393b930434a7845d8d95a2a3c33
	Issue introduced in 4.7 with commit 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 and fixed in 6.6.72 with commit d5807dd1328bbc86e059c5de80d1bbee9d58ca3d
	Issue introduced in 4.7 with commit 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 and fixed in 6.12.10 with commit f559357d035877b9d0dcd273e0ff83e18e1d46aa
	Issue introduced in 4.7 with commit 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 and fixed in 6.13-rc7 with commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21648
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nf_conntrack_core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5552b4fd44be3393b930434a7845d8d95a2a3c33
	https://git.kernel.org/stable/c/d5807dd1328bbc86e059c5de80d1bbee9d58ca3d
	https://git.kernel.org/stable/c/f559357d035877b9d0dcd273e0ff83e18e1d46aa
	https://git.kernel.org/stable/c/b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13