CVE-2025-21635

rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy

State
Published
Severity
5.5 Medium
Published
Jan 19, 2025
Updated
Oct 30, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy

As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:

- Inconsistency: getting info from the reader's/writer's netns vs only from the opener's netns.

- current->nsproxy can be NULL in some cases, resulting in an 'Oops' (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).

The per-netns structure can be obtained from the table->data using container_of(), then the 'net' one can be retrieved from the listen socket (if available).

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • c6a58ffed53612be86b758df1cdb0b0f4305e9cb to before 6f353c2230c199f343406c08482940ec5d8ba89cAffected
  • c6a58ffed53612be86b758df1cdb0b0f4305e9cb to before 33b3e09a489a31b30342b77cc55290f025d95c7eAffected
  • c6a58ffed53612be86b758df1cdb0b0f4305e9cb to before de8d6de0ee27be4b2b1e5b06f04aeacbabbba492Affected
  • c6a58ffed53612be86b758df1cdb0b0f4305e9cb to before 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95cAffected
LinuxLinux
  • 4.6Affected
  • before 4.6Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.10 through 6.12.*Not affected
  • 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.