CVE-2025-38595 (GCVE-0-2025-38595)
Vulnerability from cvelistv5
Published
2025-08-19 17:03
Modified
2025-08-19 17:03
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF. dma_buf_fd() is a combination of reserving a descriptor and fd_install(). gntdev dmabuf_exp_from_pages() calls it and then proceeds to access the objects destroyed on close - starting with gntdev_dmabuf itself. Fix that by doing reserving descriptor before anything else and do fd_install() only when everything had been set up.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3edfd2353f301bfffd5ee41066e37320a59ccc2d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/532c8b51b3a8676cbf533a291f8156774f30ea87
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d59d49af4aeed9a81e673e37c26c6a3bacf1a181
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e5907885260401bba300d4d18d79875c05b82651
Impacted products
Vendor Product Version
Linux Linux Version: a240d6e42e28c34fdc34b3a98ca838a31c939901
Version: a240d6e42e28c34fdc34b3a98ca838a31c939901
Version: a240d6e42e28c34fdc34b3a98ca838a31c939901
Version: a240d6e42e28c34fdc34b3a98ca838a31c939901
 Create a notification for this product.
   Linux Linux Version: 4.19
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/gntdev-dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e5907885260401bba300d4d18d79875c05b82651",
              "status": "affected",
              "version": "a240d6e42e28c34fdc34b3a98ca838a31c939901",
              "versionType": "git"
            },
            {
              "lessThan": "3edfd2353f301bfffd5ee41066e37320a59ccc2d",
              "status": "affected",
              "version": "a240d6e42e28c34fdc34b3a98ca838a31c939901",
              "versionType": "git"
            },
            {
              "lessThan": "d59d49af4aeed9a81e673e37c26c6a3bacf1a181",
              "status": "affected",
              "version": "a240d6e42e28c34fdc34b3a98ca838a31c939901",
              "versionType": "git"
            },
            {
              "lessThan": "532c8b51b3a8676cbf533a291f8156774f30ea87",
              "status": "affected",
              "version": "a240d6e42e28c34fdc34b3a98ca838a31c939901",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/gntdev-dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17-rc1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: fix UAF in dmabuf_exp_from_pages()\n\n[dma_buf_fd() fixes; no preferences regarding the tree it goes through -\nup to xen folks]\n\nAs soon as we\u0027d inserted a file reference into descriptor table, another\nthread could close it.  That\u0027s fine for the case when all we are doing is\nreturning that descriptor to userland (it\u0027s a race, but it\u0027s a userland\nrace and there\u0027s nothing the kernel can do about it).  However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its -\u003erelease()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\ngntdev dmabuf_exp_from_pages() calls it and then proceeds to access the\nobjects destroyed on close - starting with gntdev_dmabuf itself.\n\nFix that by doing reserving descriptor before anything else and do\nfd_install() only when everything had been set up."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-19T17:03:25.527Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e5907885260401bba300d4d18d79875c05b82651"
        },
        {
          "url": "https://git.kernel.org/stable/c/3edfd2353f301bfffd5ee41066e37320a59ccc2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d59d49af4aeed9a81e673e37c26c6a3bacf1a181"
        },
        {
          "url": "https://git.kernel.org/stable/c/532c8b51b3a8676cbf533a291f8156774f30ea87"
        }
      ],
      "title": "xen: fix UAF in dmabuf_exp_from_pages()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38595",
    "datePublished": "2025-08-19T17:03:25.527Z",
    "dateReserved": "2025-04-16T04:51:24.028Z",
    "dateUpdated": "2025-08-19T17:03:25.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38595\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-19T17:15:37.343\",\"lastModified\":\"2025-08-20T14:40:17.713\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxen: fix UAF in dmabuf_exp_from_pages()\\n\\n[dma_buf_fd() fixes; no preferences regarding the tree it goes through -\\nup to xen folks]\\n\\nAs soon as we\u0027d inserted a file reference into descriptor table, another\\nthread could close it.  That\u0027s fine for the case when all we are doing is\\nreturning that descriptor to userland (it\u0027s a race, but it\u0027s a userland\\nrace and there\u0027s nothing the kernel can do about it).  However, if we\\nfollow fd_install() with any kind of access to objects that would be\\ndestroyed on close (be it the struct file itself or anything destroyed\\nby its -\u003erelease()), we have a UAF.\\n\\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\\ngntdev dmabuf_exp_from_pages() calls it and then proceeds to access the\\nobjects destroyed on close - starting with gntdev_dmabuf itself.\\n\\nFix that by doing reserving descriptor before anything else and do\\nfd_install() only when everything had been set up.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xen: correcci\u00f3n de UAF en dmabuf_exp_from_pages() [dma_buf_fd() corrige; no hay preferencias sobre el \u00e1rbol que recorre - depende de los usuarios de xen]. En cuanto insertamos una referencia a un archivo en la tabla de descriptores, otro hilo podr\u00eda cerrarla. Esto funciona bien cuando solo devolvemos ese descriptor al espacio de usuario (es una ejecuci\u00f3n, pero es una ejecuci\u00f3n de espacio de usuario y el kernel no puede hacer nada al respecto). Sin embargo, si despu\u00e9s de fd_install() accedemos a objetos que se destruir\u00edan al cerrar (ya sea el propio archivo de estructura o cualquier objeto destruido por su -\u0026gt;release()), tenemos un UAF. dma_buf_fd() combina la reserva de un descriptor con fd_install(). gntdev dmabuf_exp_from_pages() lo llama y procede a acceder a los objetos destruidos al cerrar, empezando por el propio gntdev_dmabuf. Arregle esto reservando el descriptor antes de cualquier otra cosa y ejecutando fd_install() solo cuando todo est\u00e9 configurado.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3edfd2353f301bfffd5ee41066e37320a59ccc2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/532c8b51b3a8676cbf533a291f8156774f30ea87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d59d49af4aeed9a81e673e37c26c6a3bacf1a181\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e5907885260401bba300d4d18d79875c05b82651\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.