linux-cve-announce - CVE-2025-21950: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025040136-CVE-2025-21950-11d2@gregkh>
Date: Tue,  1 Apr 2025 16:40:14 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-21950: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl

In the "pmcmd_ioctl" function, three memory objects allocated by
kmalloc are initialized by "hcall_get_cpu_state", which are then
copied to user space. The initializer is indeed implemented in
"acrn_hypercall2" (arch/x86/include/asm/acrn.h). There is a risk of
information leakage due to uninitialized bytes.

The Linux kernel CVE team has assigned CVE-2025-21950 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.12 with commit 3d679d5aec648f50e645702929890b9611998a0b and fixed in 5.15.179 with commit 4e15cf870d2c748e45d45ffc4d5b1dc1b7d50120
	Issue introduced in 5.12 with commit 3d679d5aec648f50e645702929890b9611998a0b and fixed in 6.1.131 with commit 524f29d78c9bdeb49f31f5b0376a07d2fc5cf563
	Issue introduced in 5.12 with commit 3d679d5aec648f50e645702929890b9611998a0b and fixed in 6.6.83 with commit d7e5031fe3f161c8eb5e84db1540bc4373ed861b
	Issue introduced in 5.12 with commit 3d679d5aec648f50e645702929890b9611998a0b and fixed in 6.12.19 with commit 1b8f7a2caa7f9cdfd135e3f78eb9d7e36fb95083
	Issue introduced in 5.12 with commit 3d679d5aec648f50e645702929890b9611998a0b and fixed in 6.13.7 with commit a4c21b878f0e237f45209a324c903ea7fb05247d
	Issue introduced in 5.12 with commit 3d679d5aec648f50e645702929890b9611998a0b and fixed in 6.14 with commit 819cec1dc47cdeac8f5dd6ba81c1dbee2a68c3bb

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21950
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/virt/acrn/hsm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4e15cf870d2c748e45d45ffc4d5b1dc1b7d50120
	https://git.kernel.org/stable/c/524f29d78c9bdeb49f31f5b0376a07d2fc5cf563
	https://git.kernel.org/stable/c/d7e5031fe3f161c8eb5e84db1540bc4373ed861b
	https://git.kernel.org/stable/c/1b8f7a2caa7f9cdfd135e3f78eb9d7e36fb95083
	https://git.kernel.org/stable/c/a4c21b878f0e237f45209a324c903ea7fb05247d
	https://git.kernel.org/stable/c/819cec1dc47cdeac8f5dd6ba81c1dbee2a68c3bb