linux-cve-announce - CVE-2025-38074: vhost-scsi: protect vq->log

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061839-CVE-2025-38074-dc14@gregkh>
Date: Wed, 18 Jun 2025 11:34:09 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vhost-scsi: protect vq->log_used with vq->mutex

The vhost-scsi completion path may access vq->log_base when vq->log_used is
already set to false.

    vhost-thread                       QEMU-thread

vhost_scsi_complete_cmd_work()
-> vhost_add_used()
   -> vhost_add_used_n()
      if (unlikely(vq->log_used))
                                      QEMU disables vq->log_used
                                      via VHOST_SET_VRING_ADDR.
                                      mutex_lock(&vq->mutex);
                                      vq->log_used = false now!
                                      mutex_unlock(&vq->mutex);

				      QEMU gfree(vq->log_base)
        log_used()
        -> log_write(vq->log_base)

Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be
reclaimed via gfree(). As a result, this causes invalid memory writes to
QEMU userspace.

The control queue path has the same issue.

The Linux kernel CVE team has assigned CVE-2025-38074 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.6.93 with commit ca85c2d0db5f8309832be45858b960d933c2131c
	Fixed in 6.12.31 with commit bd8c9404e44adb9f6219c09b3409a61ab7ce3427
	Fixed in 6.14.9 with commit c0039e3afda29be469d29b3013d7f9bdee136834
	Fixed in 6.15 with commit f591cf9fce724e5075cc67488c43c6e39e8cbe27

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38074
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/vhost/scsi.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c
	https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427
	https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834
	https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27