| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025040134-CVE-2025-21935-4288@gregkh> Date: Tue, 1 Apr 2025 16:39:59 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2025-21935: rapidio: add check for rio_add_net() in rio_scan_alloc_net() Description =========== In the Linux kernel, the following vulnerability has been resolved: rapidio: add check for rio_add_net() in rio_scan_alloc_net() The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). The Linux kernel CVE team has assigned CVE-2025-21935 to this issue. Affected and fixed versions =========================== Issue introduced in 4.6 with commit e6b585ca6e81badeb3d42db3cc408174f2826034 and fixed in 5.4.291 with commit 6d22953c4a183d0b7fdf34d68c5debd16da6edc5 Issue introduced in 4.6 with commit e6b585ca6e81badeb3d42db3cc408174f2826034 and fixed in 5.10.235 with commit 4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 Issue introduced in 4.6 with commit e6b585ca6e81badeb3d42db3cc408174f2826034 and fixed in 5.15.179 with commit 181d4daaefb3bceeb2f2635ba9f3781eeda9e550 Issue introduced in 4.6 with commit e6b585ca6e81badeb3d42db3cc408174f2826034 and fixed in 6.1.131 with commit ad82be4298a89a9ae46f07128bdf3d8614bce745 Issue introduced in 4.6 with commit e6b585ca6e81badeb3d42db3cc408174f2826034 and fixed in 6.6.83 with commit e6411c3b9512dba09af7d014d474516828c89706 Issue introduced in 4.6 with commit e6b585ca6e81badeb3d42db3cc408174f2826034 and fixed in 6.12.19 with commit c332f3e2df0fcae5a45fd55cc18902fb1e4825ca Issue introduced in 4.6 with commit e6b585ca6e81badeb3d42db3cc408174f2826034 and fixed in 6.13.7 with commit a0d069ccc475abaaa79c6368ee27fc0b5912bea8 Issue introduced in 4.6 with commit e6b585ca6e81badeb3d42db3cc408174f2826034 and fixed in 6.14 with commit e842f9a1edf306bf36fe2a4d847a0b0d458770de Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-21935 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/rapidio/rio-scan.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/6d22953c4a183d0b7fdf34d68c5debd16da6edc5 https://git.kernel.org/stable/c/4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 https://git.kernel.org/stable/c/181d4daaefb3bceeb2f2635ba9f3781eeda9e550 https://git.kernel.org/stable/c/ad82be4298a89a9ae46f07128bdf3d8614bce745 https://git.kernel.org/stable/c/e6411c3b9512dba09af7d014d474516828c89706 https://git.kernel.org/stable/c/c332f3e2df0fcae5a45fd55cc18902fb1e4825ca https://git.kernel.org/stable/c/a0d069ccc475abaaa79c6368ee27fc0b5912bea8 https://git.kernel.org/stable/c/e842f9a1edf306bf36fe2a4d847a0b0d458770de
Powered by blists - more mailing lists