linux-cve-announce - CVE-2025-38451: md/md-bitmap: fix GPF in bitmap_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025072504-CVE-2025-38451-ee66@gregkh>
Date: Fri, 25 Jul 2025 17:28:13 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38451: md/md-bitmap: fix GPF in bitmap_get_stats()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

md/md-bitmap: fix GPF in bitmap_get_stats()

The commit message of commit 6ec1f0239485 ("md/md-bitmap: fix stats
collection for external bitmaps") states:

    Remove the external bitmap check as the statistics should be
    available regardless of bitmap storage location.

    Return -EINVAL only for invalid bitmap with no storage (neither in
    superblock nor in external file).

But, the code does not adhere to the above, as it does only check for
a valid super-block for "internal" bitmaps. Hence, we observe:

Oops: GPF, probably for non-canonical address 0x1cd66f1f40000028
RIP: 0010:bitmap_get_stats+0x45/0xd0
Call Trace:

 seq_read_iter+0x2b9/0x46a
 seq_read+0x12f/0x180
 proc_reg_read+0x57/0xb0
 vfs_read+0xf6/0x380
 ksys_read+0x6d/0xf0
 do_syscall_64+0x8c/0x1b0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

We fix this by checking the existence of a super-block for both the
internal and external case.

The Linux kernel CVE team has assigned CVE-2025-38451 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1.135 with commit 065f4b1cd41d03702426af44193894b925607073 and fixed in 6.1.146 with commit a23b16ba3274961494f5ad236345d238364349ff
	Issue introduced in 6.6.88 with commit 0b5390aeaa85eb2f15e0e2ea0731c0995285db5e and fixed in 6.6.99 with commit 3d82a729530bd2110ba66e4a1f73461c776edec2
	Issue introduced in 6.12.25 with commit eeeba7f43ae27835718a5f5ad6552a8983e75201 and fixed in 6.12.39 with commit 3e0542701b37aa25b025d8531583458e4f014c2e
	Issue introduced in 6.15 with commit 6ec1f0239485028445d213d91cfee5242f3211ba and fixed in 6.15.7 with commit a18f9b08c70e10ea3a897058fee8a4f3b4c146ec
	Issue introduced in 6.15 with commit 6ec1f0239485028445d213d91cfee5242f3211ba and fixed in 6.16-rc6 with commit c17fb542dbd1db745c9feac15617056506dd7195
	Issue introduced in 6.14.4 with commit 896a6fbefc9050cf940ed57947eda6dc23aa58b0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38451
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/md/md-bitmap.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a23b16ba3274961494f5ad236345d238364349ff
	https://git.kernel.org/stable/c/3d82a729530bd2110ba66e4a1f73461c776edec2
	https://git.kernel.org/stable/c/3e0542701b37aa25b025d8531583458e4f014c2e
	https://git.kernel.org/stable/c/a18f9b08c70e10ea3a897058fee8a4f3b4c146ec
	https://git.kernel.org/stable/c/c17fb542dbd1db745c9feac15617056506dd7195