linux-cve-announce - CVE-2025-23138: watch_queue: fix pipe accounting mismatch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025041634-CVE-2025-23138-a5c8@gregkh>
Date: Wed, 16 Apr 2025 16:13:49 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-23138: watch_queue: fix pipe accounting mismatch

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

watch_queue: fix pipe accounting mismatch

Currently, watch_queue_set_size() modifies the pipe buffers charged to
user->pipe_bufs without updating the pipe->nr_accounted on the pipe
itself, due to the if (!pipe_has_watch_queue()) test in
pipe_resize_ring(). This means that when the pipe is ultimately freed,
we decrement user->pipe_bufs by something other than what than we had
charged to it, potentially leading to an underflow. This in turn can
cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.

To remedy this, explicitly account for the pipe usage in
watch_queue_set_size() to match the number set via account_pipe_buffers()

(It's unclear why watch_queue_set_size() does not update nr_accounted;
it may be due to intentional overprovisioning in watch_queue_set_size()?)

The Linux kernel CVE team has assigned CVE-2025-23138 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.210 with commit 162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8 and fixed in 5.10.236 with commit 8658c75343ed00e5e154ebbe24335f51ba8db547
	Issue introduced in 5.15.149 with commit 3efbd114b91525bb095b8ae046382197d92126b9 and fixed in 5.15.180 with commit 471c89b7d4f58bd6082f7c1fe14d4ca15c7f1284
	Issue introduced in 6.1.76 with commit b87a1229d8668fbc78ebd9ca0fc797a76001c60f and fixed in 6.1.134 with commit d40e3537265dea9e3c33021874437ff26dc18787
	Issue introduced in 6.6.15 with commit 68e51bdb1194f11d3452525b99c98aff6f837b24 and fixed in 6.6.87 with commit 6dafa27764183738dc5368b669b71e3d0d154f12
	Issue introduced in 6.8 with commit e95aada4cb93d42e25c30a0ef9eb2923d9711d4a and fixed in 6.12.23 with commit 56ec918e6c86c1536870e4373e91eddd0c44245f
	Issue introduced in 6.8 with commit e95aada4cb93d42e25c30a0ef9eb2923d9711d4a and fixed in 6.13.11 with commit 2d680b988656bb556c863d8b46d9b9096842bf3d
	Issue introduced in 6.8 with commit e95aada4cb93d42e25c30a0ef9eb2923d9711d4a and fixed in 6.14.2 with commit 205028ebba838938d3b264dda1d0708fa7fe1ade
	Issue introduced in 6.8 with commit e95aada4cb93d42e25c30a0ef9eb2923d9711d4a and fixed in 6.15-rc1 with commit f13abc1e8e1a3b7455511c4e122750127f6bc9b0
	Issue introduced in 6.7.3 with commit 6fb70694f8d1ac34e45246b0ac988f025e1e5b55

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-23138
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/watch_queue.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8658c75343ed00e5e154ebbe24335f51ba8db547
	https://git.kernel.org/stable/c/471c89b7d4f58bd6082f7c1fe14d4ca15c7f1284
	https://git.kernel.org/stable/c/d40e3537265dea9e3c33021874437ff26dc18787
	https://git.kernel.org/stable/c/6dafa27764183738dc5368b669b71e3d0d154f12
	https://git.kernel.org/stable/c/56ec918e6c86c1536870e4373e91eddd0c44245f
	https://git.kernel.org/stable/c/2d680b988656bb556c863d8b46d9b9096842bf3d
	https://git.kernel.org/stable/c/205028ebba838938d3b264dda1d0708fa7fe1ade
	https://git.kernel.org/stable/c/f13abc1e8e1a3b7455511c4e122750127f6bc9b0