GHSA-2V78-H87M-HPX9

Vulnerability from github – Published: 2025-07-25 15:30 – Updated: 2025-11-03 18:31
VLAI?
Details

In the Linux kernel, the following vulnerability has been resolved:

rose: fix dangling neighbour pointers in rose_rt_device_down()

There are two bugs in rose_rt_device_down() that can cause use-after-free:

  1. The loop bound t->count is modified within the loop, which can cause the loop to terminate early and miss some entries.

  2. When removing an entry from the neighbour array, the subsequent entries are moved up to fill the gap, but the loop index i is still incremented, causing the next entry to be skipped.

For example, if a node has three neighbours (A, A, B) with count=3 and A is being removed, the second A is not checked.

i=0: (A, A, B) -> (A, B) with count=2
      ^ checked
i=1: (A, B)    -> (A, B) with count=2
         ^ checked (B, not A!)
i=2: (doesn't occur because i < count is false)

This leaves the second A in the array with count=2, but the rose_neigh structure has been freed. Code that accesses these entries assumes that the first count entries are valid pointers, causing a use-after-free when it accesses the dangling pointer.

Fix both issues by iterating over the array in reverse order with a fixed loop bound. This ensures that all entries are examined and that the removal of an entry doesn't affect subsequent iterations.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-38377"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-25T13:15:26Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrose: fix dangling neighbour pointers in rose_rt_device_down()\n\nThere are two bugs in rose_rt_device_down() that can cause\nuse-after-free:\n\n1. The loop bound `t-\u003ecount` is modified within the loop, which can\n   cause the loop to terminate early and miss some entries.\n\n2. When removing an entry from the neighbour array, the subsequent entries\n   are moved up to fill the gap, but the loop index `i` is still\n   incremented, causing the next entry to be skipped.\n\nFor example, if a node has three neighbours (A, A, B) with count=3 and A\nis being removed, the second A is not checked.\n\n    i=0: (A, A, B) -\u003e (A, B) with count=2\n          ^ checked\n    i=1: (A, B)    -\u003e (A, B) with count=2\n             ^ checked (B, not A!)\n    i=2: (doesn\u0027t occur because i \u003c count is false)\n\nThis leaves the second A in the array with count=2, but the rose_neigh\nstructure has been freed. Code that accesses these entries assumes that\nthe first `count` entries are valid pointers, causing a use-after-free\nwhen it accesses the dangling pointer.\n\nFix both issues by iterating over the array in reverse order with a fixed\nloop bound. This ensures that all entries are examined and that the removal\nof an entry doesn\u0027t affect subsequent iterations.",
  "id": "GHSA-2v78-h87m-hpx9",
  "modified": "2025-11-03T18:31:26Z",
  "published": "2025-07-25T15:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38377"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b952dbb32fef835756f07ff0cd77efbb836dfea"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2c6c82ee074bfcfd1bc978ec45bfea37703d840a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/34a500caf48c47d5171f4aa1f237da39b07c6157"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/446ac00b86be1670838e513b643933d78837d8db"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7a1841c9609377e989ec41c16551309ce79c39e4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/94e0918e39039c47ddceb609500817f7266be756"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b6b232e16e08c6dc120672b4753392df0d28c1b4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fe62a35fb1f77f494ed534fc69a9043dc5a30ce1"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.