Bug 2360273 (CVE-2025-22063) - CVE-2025-22063 kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
Summary: CVE-2025-22063 kernel: netlabel: Fix NULL pointer exception caused by CALIPSO...
Keywords:
Status: NEW
Alias: CVE-2025-22063
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-16 15:05 UTC by OSIDB Bzimport
Modified: 2025-04-17 09:30 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-04-16 15:05:49 UTC
In the Linux kernel, the following vulnerability has been resolved:

netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

When calling netlbl_conn_setattr(), addr->sa_family is used
to determine the function behavior. If sk is an IPv4 socket,
but the connect function is called with an IPv6 address,
the function calipso_sock_setattr() is triggered.
Inside this function, the following code is executed:

sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL;

Since sk is an IPv4 socket, pinet6 is NULL, leading to a
null pointer dereference.

This patch fixes the issue by checking if inet6_sk(sk)
returns a NULL pointer before accessing pinet6.

Comment 1 Avinash Hanwate 2025-04-17 07:59:17 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025041607-CVE-2025-22063-dec0@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.