cbcvebase.
CVE-2025-38181
published 2025-07-04

CVE-2025-38181: In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a…

medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr(). Since commit a1a5344ddbe8 ("tcp: avoid two atomic ops for syncookies"), reqsk->rsk_listener could be NULL when SYN Cookie is returned to its client, as hinted by the leading SYN Cookie log. Here are 3 options to fix the bug: 1) Return 0 in calipso_req_setattr() 2) Return an error in calipso_req_setattr() 3) Alaways set rsk_listener 1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie for CALIPSO. 3) is also no go as there have been many efforts to reduce atomic ops and make TCP robust against DDoS. See also commit 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood"). As of the blamed commit, SYN Cookie already did not need refcounting, and no one has stumbled on the bug for 9 years, so no CALIPSO user will care about SYN Cookie. Let's return an error in calipso_req_setattr() and calipso_req_delattr() in the SYN Cookie case. This can be reproduced by [1] on Fedora and now connect() of nc times out. [0]: TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 3 UID: 0 PID: 12262 Comm: syz.1.2611 Not tainted 6.14.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_pnet include/net/net_namespace.h:406 [inline] RIP: 0010:sock_net include/net/sock.h:655 [inline] RIP: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806 Code: 89 d5 41 54 55 89 f5 53 48 89 fb e8 25 e3 c6 fd e8 f0 91 e3 00 48 8d 7b 30 48 b8 00 00 00 00

Affected

37 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
debianlinux-6.1< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
linuxlinux
linuxlinux>= e1adea927080821ebfa7505bff752a4015955660 < 956f1499412ed0953f6a116df7fdb855e9f1fc66956f1499412ed0953f6a116df7fdb855e9f1fc66
linuxlinux>= e1adea927080821ebfa7505bff752a4015955660 < f4ae0f61dd9a63329ecb49b1e6356139d43240b8f4ae0f61dd9a63329ecb49b1e6356139d43240b8
linuxlinux>= e1adea927080821ebfa7505bff752a4015955660 < dc724bd34d56f5589f7587a091a8cda2386826c4dc724bd34d56f5589f7587a091a8cda2386826c4
linuxlinux>= e1adea927080821ebfa7505bff752a4015955660 < 058dd4a370f23a5553a9449f2db53d5bfa88d45e058dd4a370f23a5553a9449f2db53d5bfa88d45e
linuxlinux>= e1adea927080821ebfa7505bff752a4015955660 < bde8833eb075ba8e8674de88e32de6b669966451bde8833eb075ba8e8674de88e32de6b669966451
linuxlinux>= e1adea927080821ebfa7505bff752a4015955660 < 988edde4d52d5c02ea4dd95d7619372a5e2fb7b7988edde4d52d5c02ea4dd95d7619372a5e2fb7b7
linuxlinux>= e1adea927080821ebfa7505bff752a4015955660 < d092c7fd8e220b23d6c47e03d7d0cc79e731f379d092c7fd8e220b23d6c47e03d7d0cc79e731f379
linuxlinux>= e1adea927080821ebfa7505bff752a4015955660 < 10876da918fa1aec0227fb4c67647513447f53a910876da918fa1aec0227fb4c67647513447f53a9
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.244-15.10.244-1
linuxlinux_kernel>= 0 < 6.1.147-16.1.147-1
linuxlinux_kernel>= 0 < 6.12.35-16.12.35-1
linuxlinux_kernel>= 0 < 6.12.35-16.12.35-1
linuxlinux_kernel>= 0 < 5.15.0-156.1665.15.0-156.166
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 4.8 < 5.4.2955.4.295
linuxlinux_kernel>= 5.11 < 5.15.1865.15.186
linuxlinux_kernel>= 5.16 < 6.1.1426.1.142
linuxlinux_kernel>= 5.5 < 5.10.2395.10.239
linuxlinux_kernel>= 6.13 < 6.15.46.15.4
linuxlinux_kernel>= 6.2 < 6.6.956.6.95

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.6MEDIUM