CVE-2025-21670

vsock/bpf: return early if transport is not assigned

Medium · published January 31, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

vsock/bpf: return early if transport is not assigned

Some of the core functions can only be called if the transport

has been assigned.

As Michal reported, a socket might have the transport at NULL,

for example after a failed connect(), causing the following trace:

BUG: kernel NULL pointer dereference, address: 00000000000000a0

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0

Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI

CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+

RIP: 0010:vsock_connectible_has_data+0x1f/0x40

Call Trace:

vsock_bpf_recvmsg+0xca/0x5e0

sock_recvmsg+0xb9/0xc0

__sys_recvfrom+0xb3/0x130

__x64_sys_recvfrom+0x20/0x30

do_syscall_64+0x93/0x180

entry_SYSCALL_64_after_hwframe+0x76/0x7e

So we need to check the `vsk->transport` in vsock_bpf_recvmsg(),

especially for connected sockets (stream/seqpacket) as we already

do in __vsock_connectible_recvmsg().

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Published
2025-01-31T11:25Z
EPSS history
Timeline
  • 31 JAN 11:25Z
    vsock/bpf: return early if transport is not assigned
    cvelistv5