Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

net/packet: fix a race in packet_set_ring() and packet_notifier() (Linux Linux)

CVE-2025-38617
HIGH 7.8

En bref

Source
NVD
EPSS
EPSS 0.40 % · centile 34 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Rechercher sur…

Description

In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history.

Faiblesses (CWE)

  • CWE-362 — Situation de compétition

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1MEDIUM 4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 18f13f2a83eb81be349a9757ba2141ff1da9ad73 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7da733f117533e9b2ebbd530a22ae4028713955c ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ba2257034755ae773722f15f4c3ad1dcdad15ca9 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7de07705007c7e34995a5599aaab1d23e762d7ca ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 88caf46db8239e6471413d28aabaa6b8bd552805 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f2e8fcfd2b1bc754920108b7f2cd75082c5a18df
Linux · Linuxaffected 2.6.12 ; unaffected 0 < 2.6.12 ; unaffected 5.4.297 ≤ 5.4.* ; unaffected 5.10.241 ≤ 5.10.* ; unaffected 5.15.190 ≤ 5.15.* ; unaffected 6.1.148 ≤ 6.1.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD