linux-cve-announce - CVE-2025-21792: ax25: Fix refcount leak caused by setting SO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025022609-CVE-2025-21792-d8e8@gregkh>
Date: Wed, 26 Feb 2025 18:17:48 -0800
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt

If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE
socket option, a refcount leak will occur in ax25_release().

Commit 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()")
added decrement of device refcounts in ax25_release(). In order for that
to work correctly the refcounts must already be incremented when the
device is bound to the socket. An AX25 device can be bound to a socket
by either calling ax25_bind() or setting SO_BINDTODEVICE socket option.
In both cases the refcounts should be incremented, but in fact it is done
only in ax25_bind().

This bug leads to the following issue reported by Syzkaller:

================================================================
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31
Modules linked in:
CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31
Call Trace:
 <TASK>
 __refcount_dec include/linux/refcount.h:336 [inline]
 refcount_dec include/linux/refcount.h:351 [inline]
 ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236
 netdev_tracker_free include/linux/netdevice.h:4156 [inline]
 netdev_put include/linux/netdevice.h:4173 [inline]
 netdev_put include/linux/netdevice.h:4169 [inline]
 ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069
 __sock_release+0xb0/0x270 net/socket.c:640
 sock_close+0x1c/0x30 net/socket.c:1408
 ...
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 ...
 </TASK>
================================================================

Fix the implementation of ax25_setsockopt() by adding increment of
refcounts for the new device bound, and decrement of refcounts for
the old unbound device.

The Linux kernel CVE team has assigned CVE-2025-21792 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.18 with commit 9fd75b66b8f68498454d685dc4ba13192ae069b0 and fixed in 6.1.129 with commit 90056ece99966182dc0e367f3fd2afab46ada847
	Issue introduced in 5.18 with commit 9fd75b66b8f68498454d685dc4ba13192ae069b0 and fixed in 6.6.79 with commit 94a0de224ed52eb2ecd4f4cb1b937b674c9fb955
	Issue introduced in 5.18 with commit 9fd75b66b8f68498454d685dc4ba13192ae069b0 and fixed in 6.12.16 with commit b58f7ca86a7b8e480c06e30c5163c5d2f4e24023
	Issue introduced in 5.18 with commit 9fd75b66b8f68498454d685dc4ba13192ae069b0 and fixed in 6.13.4 with commit 470bda72fda0fcf54300466d70ce2de62f7835d2
	Issue introduced in 5.18 with commit 9fd75b66b8f68498454d685dc4ba13192ae069b0 and fixed in 6.14-rc3 with commit bca0902e61731a75fc4860c8720168d9f1bae3b6
	Issue introduced in 4.14.277 with commit c44a453ffe16eb08acdc6129ac4fa0192dbc0456
	Issue introduced in 4.19.240 with commit de55a1338e6a48ff1e41ea8db1432496fbe2a62b
	Issue introduced in 5.4.190 with commit 9e1e088a57c23251f1cfe9601bbd90ade2ea73b9
	Issue introduced in 5.10.112 with commit b20a5ab0f5fb175750c6bafd4cf12daccf00c738
	Issue introduced in 5.15.35 with commit 452ae92b99062d2f6a34324eaf705a3b7eac9f8b
	Issue introduced in 5.17.2 with commit 534156dd4ed768e30a43de0036f45dca7c54818f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21792
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ax25/af_ax25.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/90056ece99966182dc0e367f3fd2afab46ada847
	https://git.kernel.org/stable/c/94a0de224ed52eb2ecd4f4cb1b937b674c9fb955
	https://git.kernel.org/stable/c/b58f7ca86a7b8e480c06e30c5163c5d2f4e24023
	https://git.kernel.org/stable/c/470bda72fda0fcf54300466d70ce2de62f7835d2
	https://git.kernel.org/stable/c/bca0902e61731a75fc4860c8720168d9f1bae3b6