Bug 2366848 (CVE-2025-37890)
| Summary: | CVE-2025-37890 kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | anbernal, dfreiber, drow, jburrell, mcascell, vkumar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A use-after-free vulnerability has been identified in the Linux kernel's HFSC (Hierarchical Fair Service Curve) queuing discipline when it is configured with NETEM (Network Emulation) as a child. This flaw can lead to a kernel panic or crash due to incorrect assumptions about the queue state.
Exploitation of this vulnerability requires local access with CAP_NET_ADMIN privileges and control over the qdisc (queueing discipline) setup. A local attacker could leverage this flaw to achieve denial of service or escalate privileges. Given that it affects kernel memory structures, successful exploitation could result in memory corruption, data leaks, or arbitrary write capabilities, leading to a full kernel crash.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2025-05-16 14:01:18 UTC
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2025051617-CVE-2025-37890-437b@gregkh/T This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:12662 https://access.redhat.com/errata/RHSA-2025:12662 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:12746 https://access.redhat.com/errata/RHSA-2025:12746 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:12753 https://access.redhat.com/errata/RHSA-2025:12753 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:12752 https://access.redhat.com/errata/RHSA-2025:12752 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:13135 https://access.redhat.com/errata/RHSA-2025:13135 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2025:14511 https://access.redhat.com/errata/RHSA-2025:14511 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2025:14692 https://access.redhat.com/errata/RHSA-2025:14692 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2025:14742 https://access.redhat.com/errata/RHSA-2025:14742 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:14744 https://access.redhat.com/errata/RHSA-2025:14744 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:14749 https://access.redhat.com/errata/RHSA-2025:14749 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2025:15035 https://access.redhat.com/errata/RHSA-2025:15035 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2025:16539 https://access.redhat.com/errata/RHSA-2025:16539 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:16541 https://access.redhat.com/errata/RHSA-2025:16541 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:16540 https://access.redhat.com/errata/RHSA-2025:16540 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:16538 https://access.redhat.com/errata/RHSA-2025:16538 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Via RHSA-2025:16580 https://access.redhat.com/errata/RHSA-2025:16580 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:16582 https://access.redhat.com/errata/RHSA-2025:16582 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Via RHSA-2025:16583 https://access.redhat.com/errata/RHSA-2025:16583 |