{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21924", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.788Z", "datePublished": "2025-04-01T15:40:56.841Z", "dateUpdated": "2026-08-05T11:55:22.940Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:22.940Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error\n\nDuring the initialization of ptp, hclge_ptp_get_cycle might return an error\nand returned directly without unregister clock and free it. To avoid that,\ncall hclge_ptp_destroy_clock to unregist and free clock if\nhclge_ptp_get_cycle failed." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local access to the stale PTP clock left behind — reading world-readable `/sys/class/ptp/ptpN/clock_name` or issuing ioctls/clock_adjtime on `/dev/ptpN`; no network traffic reaches this code.\nAC:L - On an affected platform the dangling `ptp_clock` is created deterministically on every failed probe/reset with no race to win and no memory-layout precondition, so the attacker can dereference the freed `ptp_clock_info` at will.\nPR:L - The PTP sysfs attributes that dereference the freed `ptp->info` (`clock_name`, `max_adjustment`, `n_*`) are mode 0444, so any unprivileged local account can trigger the use-after-free; `/dev/ptpN` widens this further where PTP daemons/containers are granted access.\nUI:N - The dangling registration is created by driver probe or device reset at boot; the attacker acts alone and needs no victim to perform any action.\nS:U - The freed devm slab object and the PTP core both reside in the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free of the `hclge_ptp` object leaks reallocated slab contents through `sysfs_emit(\"%s\", ptp->info->name)`, and `hclge_ptp_gettimex()` returns `readl()` from an `io_base` taken from the freed object, yielding an attacker-directed read primitive.\nI:H - `hclge_ptp_settime()`/`adjtime()`/`adjfine()` perform `writel(attacker_value, hdev->ptp->io_base + off)` with both value and address sourced from the freed allocation, giving an arbitrary-write primitive once the slab is groomed, plus dangling function pointers in `ptp_clock_info` for control-flow hijack.\nA:H - Any access to the orphaned PTP clock dereferences freed memory (and unmapped MMIO after `pcim_iounmap`), reliably producing an oops or panic; the reset path additionally leaves `cycle.den == 0` reachable by `div_u64_rem()`." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c" ], "versions": [ { "version": "8373cd38a8888549ace7c7617163a2e826970a92", "lessThan": "b7d8d4529984e2d4a72a6d552fb886233e8e83cb", "status": "affected", "versionType": "git" }, { "version": "8373cd38a8888549ace7c7617163a2e826970a92", "lessThan": "33244e98aa9503585e585335fe2ceb4492630949", "status": "affected", "versionType": "git" }, { "version": "8373cd38a8888549ace7c7617163a2e826970a92", "lessThan": "2c04e507f3a5c5dc6e2b9ab37d8cdedee1ef1a37", "status": "affected", "versionType": "git" }, { "version": "8373cd38a8888549ace7c7617163a2e826970a92", "lessThan": "9cfc43c0e6e6a31122b4008d763a2960c206aa2d", "status": "affected", "versionType": "git" }, { "version": "8373cd38a8888549ace7c7617163a2e826970a92", "lessThan": "21dba813d9821687a7f9aff576798ba21a859a32", "status": "affected", "versionType": "git" }, { "version": "8373cd38a8888549ace7c7617163a2e826970a92", "lessThan": "b7365eab39831487a84e63a9638209b68dc54008", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c" ], "versions": [ { "version": "5.14", "status": "affected" }, { "version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.131", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.83", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.19", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.7", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.131" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.13.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b7d8d4529984e2d4a72a6d552fb886233e8e83cb" }, { "url": "https://git.kernel.org/stable/c/33244e98aa9503585e585335fe2ceb4492630949" }, { "url": "https://git.kernel.org/stable/c/2c04e507f3a5c5dc6e2b9ab37d8cdedee1ef1a37" }, { "url": "https://git.kernel.org/stable/c/9cfc43c0e6e6a31122b4008d763a2960c206aa2d" }, { "url": "https://git.kernel.org/stable/c/21dba813d9821687a7f9aff576798ba21a859a32" }, { "url": "https://git.kernel.org/stable/c/b7365eab39831487a84e63a9638209b68dc54008" } ], "title": "net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:39:17.991Z" } } ] } }