linux-cve-announce - CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025092301-CVE-2025-39880-17c5@gregkh>
Date: Tue, 23 Sep 2025 08:01:11 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

libceph: fix invalid accesses to ceph_connection_v1_info

There is a place where generic code in messenger.c is reading and
another place where it is writing to con->v1 union member without
checking that the union member is active (i.e. msgr1 is in use).

On 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter,
so such a read is almost guaranteed to return a bogus value instead of
0 when msgr2 is in use.  This ends up being fairly benign because the
side effect is just the invalidation of the authorizer and successive
fetching of new tickets.

con->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that
it's being written to can cause more serious consequences, but luckily
it's not something that happens often.

The Linux kernel CVE team has assigned CVE-2025-39880 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit cd1a677cad994021b19665ed476aea63f5d54f31 and fixed in 6.1.153 with commit 591ea9c30737663a471b2bb07b27ddde86b020d5
	Issue introduced in 5.11 with commit cd1a677cad994021b19665ed476aea63f5d54f31 and fixed in 6.6.107 with commit 23538cfbeed87159a5ac6c61e7a6de3d8d4486a8
	Issue introduced in 5.11 with commit cd1a677cad994021b19665ed476aea63f5d54f31 and fixed in 6.12.48 with commit 35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983
	Issue introduced in 5.11 with commit cd1a677cad994021b19665ed476aea63f5d54f31 and fixed in 6.16.8 with commit 6bd8b56899be0b514945f639a89ccafb8f8dfaef
	Issue introduced in 5.11 with commit cd1a677cad994021b19665ed476aea63f5d54f31 and fixed in 6.17-rc6 with commit cdbc9836c7afadad68f374791738f118263c5371

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-39880
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ceph/messenger.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/591ea9c30737663a471b2bb07b27ddde86b020d5
	https://git.kernel.org/stable/c/23538cfbeed87159a5ac6c61e7a6de3d8d4486a8
	https://git.kernel.org/stable/c/35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983
	https://git.kernel.org/stable/c/6bd8b56899be0b514945f639a89ccafb8f8dfaef
	https://git.kernel.org/stable/c/cdbc9836c7afadad68f374791738f118263c5371