CVE-2025-21744

一、漏洞信息
 漏洞编号：[CVE-2025-21744](https://nvd.nist.gov/vuln/detail/CVE-2025-21744)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()On removal of the device or unloading of the kernel module a potential NULLpointer dereference occurs.The following sequence deletes the interface:  brcmf_detach()    brcmf_remove_interface()      brcmf_del_if()Inside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated toBRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches.After brcmf_remove_interface() call the brcmf_proto_detach() function iscalled providing the following sequence:  brcmf_detach()    brcmf_proto_detach()      brcmf_proto_msgbuf_detach()        brcmf_flowring_detach()          brcmf_msgbuf_delete_flowring()            brcmf_msgbuf_remove_flowring()              brcmf_flowring_delete()                brcmf_get_ifp()                brcmf_txfinalize()Since brcmf_get_ip() can and actually will return NULL in this case thecall to brcmf_txfinalize() will result in a NULL pointer dereference insidebrcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors.This will only happen if a flowring still has an skb.Although the NULL pointer dereference has only been seen when trying toupdate the tx statistic, all other uses of the ifp pointer have beenguarded as well with an early return if ifp is NULL.
 漏洞公开时间：2025-02-27 11:15:15
 漏洞创建时间：2025-02-27 13:00:16
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-21744
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2326e19190e176fd72bb542b837a9d2b7fcb8693 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3877fc67bd3d5566cc12763bce39710ceb74a97d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/4e51d6d093e763348916e69d06d87e0a5593661b |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/59ff4fa653ff6db07c61152516ffba79c2a74bda |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/61541d9b5a23df33934fcc620a3a81f246b1b240 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/68abd0c4ebf24cd499841a488b97a6873d5efabb |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/a2beefc4fa49ebc22e664dc6b39dbd054f8488f9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fbbfef2a5b858eab55741a58b2ac9a0cc8d53c58 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21744 | https://bugzilla.suse.com/show_bug.cgi?id=1238903 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21744.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1238903 |
| suse_bugzilla | https://git.kernel.org/stable/c/4e51d6d093e763348916e69d06d87e0a5593661b | https://bugzilla.suse.com/show_bug.cgi?id=1238903 |
| suse_bugzilla | https://git.kernel.org/stable/c/3877fc67bd3d5566cc12763bce39710ceb74a97d | https://bugzilla.suse.com/show_bug.cgi?id=1238903 |
| suse_bugzilla | https://git.kernel.org/stable/c/fbbfef2a5b858eab55741a58b2ac9a0cc8d53c58 | https://bugzilla.suse.com/show_bug.cgi?id=1238903 |
| suse_bugzilla | https://git.kernel.org/stable/c/a2beefc4fa49ebc22e664dc6b39dbd054f8488f9 | https://bugzilla.suse.com/show_bug.cgi?id=1238903 |
| suse_bugzilla | https://git.kernel.org/stable/c/68abd0c4ebf24cd499841a488b97a6873d5efabb | https://bugzilla.suse.com/show_bug.cgi?id=1238903 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-21744 | https://bugzilla.suse.com/show_bug.cgi?id=1238903 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2348648 | https://bugzilla.suse.com/show_bug.cgi?id=1238903 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025022600-CVE-2025-21744-2585@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2348648 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/3877fc67bd3d5566cc12763bce39710ceb74a97d |  | nvd |
|  |  | https://git.kernel.org/stable/c/4e51d6d093e763348916e69d06d87e0a5593661b |  | nvd |
|  |  | https://git.kernel.org/stable/c/68abd0c4ebf24cd499841a488b97a6873d5efabb |  | nvd |
|  |  | https://git.kernel.org/stable/c/a2beefc4fa49ebc22e664dc6b39dbd054f8488f9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/fbbfef2a5b858eab55741a58b2ac9a0cc8d53c58 |  | nvd |
| linux_kernel | 6.1.129 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4e51d6d093e763348916e69d06d87e0a5593661bFixed |  | linuxkernelcves |
| linux_kernel | 6.6.78 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3877fc67bd3d5566cc12763bce39710ceb74a97dFixed |  | linuxkernelcves |
| linux_kernel | 6.12.14 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fbbfef2a5b858eab55741a58b2ac9a0cc8d53c58Fixed |  | linuxkernelcves |
| linux_kernel | 6.13.3 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a2beefc4fa49ebc22e664dc6b39dbd054f8488f9Fixed |  | linuxkernelcves |
| linux_kernel | 6.14-rc1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=68abd0c4ebf24cd499841a488b97a6873d5efabbPlease |  | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()On removal of the device or unloading of the kernel module a potential NULLpointer dereference occurs.The following sequence deletes the interface:  brcmf_detach()    brcmf_remove_interface()      brcmf_del_if()Inside the brcmf_del_if() function the drvr-&gt;if2bss[ifidx] is updated toBRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches.After brcmf_remove_interface() call the brcmf_proto_detach() function iscalled providing the following sequence:  brcmf_detach()    brcmf_proto_detach()      brcmf_proto_msgbuf_detach()        brcmf_flowring_detach()          brcmf_msgbuf_delete_flowring()            brcmf_msgbuf_remove_flowring()              brcmf_flowring_delete()                brcmf_get_ifp()                brcmf_txfinalize()Since brcmf_get_ip() can and actually will return NULL in this case thecall to brcmf_txfinalize() will result in a NULL pointer dereference insidebrcmf_txfinalize() when trying to update ifp-&gt;ndev-&gt;stats.tx_errors.This will only happen if a flowring still has an skb.Although the NULL pointer dereference has only been seen when trying toupdate the tx statistic, all other uses of the ifp pointer have beenguarded as well with an early return if ifp is NULL.The Linux kernel CVE team has assigned CVE-2025-21744 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.6.0):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
4.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
5.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
6.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1450

src-openEuler/kernel

内容风险标识

评论 (14)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-21744

评论 (14)

搜索帮助

src-openEuler/kernel