{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37998", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.976Z", "datePublished": "2025-05-29T13:15:56.197Z", "dateUpdated": "2026-08-05T11:58:50.276Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:50.276Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: Fix unsafe attribute parsing in output_userspace()\n\nThis patch replaces the manual Netlink attribute iteration in\noutput_userspace() with nla_for_each_nested(), which ensures that only\nwell-formed attributes are processed." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The malformed action must be installed through the openvswitch generic-netlink interface (OVS_PACKET_CMD_EXECUTE or OVS_FLOW_CMD_NEW), which requires a local netlink socket. A remote peer's packets cannot introduce malformed attributes, since the datapath's action list is written only by local userspace.\nAC:L - Exploitation is fully deterministic — the attacker crafts a nested attribute with nla_len of 0, 1-3, or 0xFFFF and executes it; there is no race and no dependence on memory layout to trigger the loop or the OOB copy. Liberal netlink validation accepts the malformed trailer unconditionally.\nPR:L - The OVS genl ops use GENL_UNS_ADMIN_PERM with .netnsok = true, i.e. netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN), so an ordinary unprivileged user obtains the needed capability via `unshare -Urn` and creates their own datapath. No real root in the init namespace is required.\nUI:N - The attacker installs the action and triggers execution entirely from their own process via netlink; no victim action or cooperating process is involved.\nS:U - The corruption and disclosure are confined to the kernel that the attacker is already interacting with — standard local kernel compromise with no crossing into a hypervisor, IOMMU, or other security authority.\nC:H - A USERDATA attribute with nla_len 0xFFFF makes queue_userspace_packet() copy ~64KB from beyond the ≤32KB sw_flow_actions allocation directly into the upcall netlink message sent to the attacker's own socket, yielding a repeatable arbitrary-offset kernel heap read that defeats KASLR and leaks adjacent object contents.\nI:H - A USERDATA attribute with nla_len of 1-3 makes nla_len() negative, and queue_userspace_packet() uses __nla_put() with no tailroom check, so memcpy() is invoked with a size_t of ~2^64 — an unbounded out-of-bounds write past the skb constituting severe heap memory corruption.\nA:H - An attribute with nla_len == 0 makes NLA_ALIGN(0) == 0, so nla_next() neither advances the pointer nor decrements rem, hanging the CPU in an infinite loop inside the packet-processing path with RCU read lock held; the wild memcpy and OOB read paths additionally produce immediate oops/panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/openvswitch/actions.c" ], "versions": [ { "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "6712dc21506738f5f22b4f68b7c0d9e0df819dbd", "status": "affected", "versionType": "git" }, { "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "06b4f110c79716c181a8c5da007c259807840232", "status": "affected", "versionType": "git" }, { "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "47f7f00cf2fa3137d5c0416ef1a71bdf77901395", "status": "affected", "versionType": "git" }, { "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "bca8df998cce1fead8cbc69144862eadc2e34c87", "status": "affected", "versionType": "git" }, { "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "0236742bd959332181c1fcc41a05b7b709180501", "status": "affected", "versionType": "git" }, { "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "ec334aaab74705cc515205e1da3cb369fdfd93cd", "status": "affected", "versionType": "git" }, { "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "4fa672cbce9c86c3efb8621df1ae580d47813430", "status": "affected", "versionType": "git" }, { "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "6beb6835c1fbb3f676aebb51a5fee6b77fed9308", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/openvswitch/actions.c" ], "versions": [ { "version": "3.3", "status": "affected" }, { "version": "0", "lessThan": "3.3", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.183", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.139", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.91", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.29", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.7", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.4.294" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.10.238" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.15.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.1.139" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.6.91" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.12.29" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.14.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/6712dc21506738f5f22b4f68b7c0d9e0df819dbd" }, { "url": "https://git.kernel.org/stable/c/06b4f110c79716c181a8c5da007c259807840232" }, { "url": "https://git.kernel.org/stable/c/47f7f00cf2fa3137d5c0416ef1a71bdf77901395" }, { "url": "https://git.kernel.org/stable/c/bca8df998cce1fead8cbc69144862eadc2e34c87" }, { "url": "https://git.kernel.org/stable/c/0236742bd959332181c1fcc41a05b7b709180501" }, { "url": "https://git.kernel.org/stable/c/ec334aaab74705cc515205e1da3cb369fdfd93cd" }, { "url": "https://git.kernel.org/stable/c/4fa672cbce9c86c3efb8621df1ae580d47813430" }, { "url": "https://git.kernel.org/stable/c/6beb6835c1fbb3f676aebb51a5fee6b77fed9308" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-307/" } ], "title": "openvswitch: Fix unsafe attribute parsing in output_userspace()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:58:12.202Z" } } ] } }