| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025090544-CVE-2025-39673-61bb@gregkh> Date: Fri, 5 Sep 2025 19:20:47 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it. The Linux kernel CVE team has assigned CVE-2025-39673 to this issue. Affected and fixed versions =========================== Issue introduced in 5.13 with commit f6efc675c9dd8d93f826b79ae7e33e03301db609 and fixed in 5.15.190 with commit 9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7 Issue introduced in 5.13 with commit f6efc675c9dd8d93f826b79ae7e33e03301db609 and fixed in 6.1.149 with commit 0f1630be6fcca3f0c63e4b242ad202e5cde28a40 Issue introduced in 5.13 with commit f6efc675c9dd8d93f826b79ae7e33e03301db609 and fixed in 6.6.103 with commit ca18d751bcc9faf5b7e82e9fae1223d103928181 Issue introduced in 5.13 with commit f6efc675c9dd8d93f826b79ae7e33e03301db609 and fixed in 6.12.44 with commit 94731cc551e29511d85aa8dec61a6c071b1f2430 Issue introduced in 5.13 with commit f6efc675c9dd8d93f826b79ae7e33e03301db609 and fixed in 6.16.4 with commit f97f6475fdcb3c28ff3c55cc4b7bde632119ec08 Issue introduced in 5.13 with commit f6efc675c9dd8d93f826b79ae7e33e03301db609 and fixed in 6.17-rc3 with commit 0417adf367a0af11adf7ace849af4638cfb573f7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-39673 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ppp/ppp_generic.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9a1969fbffc1f1900d92d7594b1b7d8d72ef3dc7 https://git.kernel.org/stable/c/0f1630be6fcca3f0c63e4b242ad202e5cde28a40 https://git.kernel.org/stable/c/ca18d751bcc9faf5b7e82e9fae1223d103928181 https://git.kernel.org/stable/c/94731cc551e29511d85aa8dec61a6c071b1f2430 https://git.kernel.org/stable/c/f97f6475fdcb3c28ff3c55cc4b7bde632119ec08 https://git.kernel.org/stable/c/0417adf367a0af11adf7ace849af4638cfb573f7
Powered by blists - more mailing lists