The Linux kernel is a crucial part of a Linux-based operating system, managing and controlling the computer's hardware and various system processes. Vulnerabilities in the Linux kernel can be highly dangerous, as they may give an attacker a way to compromise the operating system, leading to unauthorized access or data theft. This post discusses a serious vulnerability, referred to as CVE-2025-21655, that has now been resolved in the kernel. The vulnerability is related to the io_uring/eventfd implementation, and the fix ensures the io_eventfd_signal() function defers another RCU (Read Copy Update) period.

Vulnerability Details

io_uring is a high-speed file I/O interface for Linux, and eventfd is a mechanism for notifying user-space applications of events detected by the kernel. The io_eventfd_do_signal() function is invoked from an RCU callback. It is responsible for dropping any references to the io_ev_fd structure, which holds the information about eventfd. However, this function called io_eventfd_free() directly if the refcount dropped to zero. This direct call is incorrect, as it should have deferred the freeing of the io_ev_fd structure another RCU grace period.

Here's the problematic code snippet in the original implementation

if (refcount_dec_and_test(&iev->ref))
    io_eventfd_free(iev);

Fix Details

In order to fix this issue, the updated implementation should call the io_eventfd_put() function, which correctly defers the freeing of the io_ev_fd structure to another RCU grace period. The updated code snippet following the fix is:

io_eventfd_put(iev);

You can compare and understand the changes made to the Linux kernel by referring to this patch from the official Linux kernel source: [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35c94f64b93d8ddd9adf83e05119b15bb8f3f105]()

Exploit Details

While there are no known exploits in the wild as of now for this particular vulnerability, it remains important to update the Linux kernel to the latest version, which includes the fix for CVE-2025-21655. Regular updates are essential for maintaining the security and stability of your system.

Conclusion

CVE-2025-21655 is a major vulnerability that affects Linux kernel's io_uring and eventfd implementation. With this recent update, the kernel now defers another RCU period in io_eventfd_signal() function, correcting the previous incorrect behavior. Users running Linux systems are advised to update their kernel as soon as possible to avoid any potential risks due to this vulnerability. For more information and updates, one can always follow the Linux kernel mailing list and other official channels to stay informed about any new developments and fixes.

Timeline

Published on: 01/20/2025 14:15:27 UTC
Last modified on: 02/23/2025 08:15:09 UTC