A notable vulnerability (CVE-2025-21636) in the Linux kernel has been brought to light and addressed. The vulnerability lies within the sctp (Stream Control Transmission Protocol) sysctl (system control) component, specifically in the plpmtud_probe_interval implementation. This post will delve into the details of this vulnerability and how it has been resolved, with a focus on code snippets, links to original references, and exploit details. We will also discuss the potential impact of this vulnerability on Linux systems and the recommended steps to mitigate its risks.

Vulnerability Details

The issue in question revolves around the use of the 'net' structure via 'current', which is discouraged for multiple reasons, as highlighted in a previous commit [2]:

1. Inconsistency: Acquiring information from the reader's/writer's netns as opposed to only from the opener's netns.
2. current->nsproxy could be NULL in specific instances, resulting in a null-ptr-deref ('Oops') error. This situation can arise when the current task is on its way out, as identified by syzbot during the use of acct(2) [1].

To resolve this vulnerability, developers are advised to obtain the 'net' structure from the table->data using container_of() instead of using 'current'. It is essential to note that table->data could also be employed directly, as the only required member from the 'net' structure, but this would increase the size of the fix and involve using '*data' in place of 'net->sctp.probe_interval' everywhere.

Code snippet demonstrating the updated approach

  struct net *net = container_of(table->data, struct net, sctp.probe_interval);
  net->sctp.probe_interval = (u32) (tmp ? : 1);

Exploit Details

As mentioned earlier, exploiting this vulnerability could lead to null pointer dereferences, crash the system or result in denial of service (DoS) attacks. Although no specific exploits have been reported at this time, it is essential to remain vigilant and apply the recommended patches as soon as possible to minimize potential risks.

Mitigation Steps

To protect Linux systems against this vulnerability, administrators should apply the necessary patches provided by the Linux kernel's maintainers as promptly as possible. Keeping systems updated with the latest security patches is crucial to ensure that they are safeguarded against known threats. Proactively checking for any new updates related to this vulnerability and keeping an eye on the Linux kernel mailing list [3] is strongly recommended.

Conclusion

In conclusion, the Linux kernel vulnerability CVE-2025-21636, which was present in the sctp sysctl component, has been successfully resolved. By appropriately modifying the code to obtain the 'net' structure from the table->data us-container_of(), developers can prevent null pointer dereferences and potential crashes or DoS attacks. Linux administrators should stay up-to-date with security updates and apply necessary patches to their systems to minimize risks.

References

[1] https://syzkaller.appspot.com/bug?id=7ea192738b3053d44eb9051c60a72740d3a978e
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=89ea525586c42698b77ed9288af93efa513cfb1
[3] https://lore.kernel.org/netdev/CAHzn_ndUOy_fcuhi5R8yMtVL-K46=Hhqs547LS1gPY9ZGBeDw@mail.gmail.com/

Timeline

Published on: 01/19/2025 11:15:09 UTC
Last modified on: 02/27/2025 21:59:09 UTC