A recently discovered vulnerability (CVE-2025-21638) within the Linux kernel has been resolved. The vulnerability was found in the sctp:sysctl:auth_enable functionality and revolved around the improper handling of the 'current->nsproxy' pointer. This could lead to inconsistencies in the handling of network namespaces and potential null pointer dereferences, possibly causing an 'Oops' message to be displayed and leading to crashes or other unintended behavior.
The main issue was that the 'net' structure was being accessed through 'current', which can be problematic for a number of reasons:
- It can lead to inconsistencies: the information could be accessing the reader's/writer's netns or the opener's netns, causing differences in behavior.
- In certain scenarios, current->nsproxy could be NULL, resulting in a null pointer dereference and an 'Oops' message, as discovered by syzbot [1] when using the acct(2) system call.
In order to address this issue, a fix has been implemented that retrieves the 'net' structure in a safe and consistent manner. This is achieved by using the container_of() macro on table->data.
The Code Snippet
The original code snippet can be found here, which is part of the Linux kernel source code. The important part of the fix looks like this:
struct net *net = container_of(table->data, struct net, sctp.sysctl_header);
By using the container_of() macro, we can safely and consistently obtain the 'net' structure from table->data. This is a more reliable method than using the 'current' pointer, which could lead to inconsistencies and potential null pointer dereferences.
Exploit Details
The vulnerability can be exploited by an attacker using a specially crafted program or script to cause the system to run into a null pointer dereference situation. While the exact steps to reproduce this issue may vary depending on the specific system, the general idea would be to create a scenario where current->nsproxy is NULL, and then interact with the sctp:sysctl:auth_enable functionality.
The best way to mitigate this vulnerability is to upgrade to the latest version of the Linux kernel that includes the aforementioned fix.
Conclusion
CVE-2025-21638 was an important Linux kernel vulnerability that has now been resolved. The issue stemmed from an unsafe and inconsistent handling of the 'current->nsproxy' pointer within the sctp:sysctl:auth_enable functionality. The implemented fix ensures that the 'net' structure is obtained in a safe and consistent manner by using the container_of() macro on table->data. This eliminates the potential for null pointer dereferences, thus providing more reliable and stable operation of the affected kernel component.
References
1. syzbot report
2. Linux Kernel Git Commit
Timeline
Published on: 01/19/2025 11:15:09 UTC
Last modified on: 02/27/2025 21:59:09 UTC