Junglewise Threat Intelligence

CVE-2025-21638: Linux Kernel NULL pointer dereference in SCTP sysctl auth_enable

CVE-2025-21638 · Severity: medium · CVSS 5.5 · Published 2025-01-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when the system attempts to access network configuration data while a process is exiting, leading to a system 'Oops' or kernel panic. This primarily impacts system availability, potentially causing a denial-of-service on affected servers.

Technical details

A NULL pointer dereference exists in the SCTP sysctl handler (proc_sctp_do_auth) within the Linux kernel. The vulnerability is caused by the code incorrectly relying on 'current->nsproxy' to obtain the network namespace ('net') structure. In specific scenarios, such as when a task is exiting (e.g., during an acct(2) syscall), 'current->nsproxy' can be NULL, leading to a kernel 'Oops'. An attacker with local access could trigger this condition to cause a denial-of-service. The fix involves obtaining the 'net' structure from 'table->data' using 'container_of()' instead of relying on the current task's proxy.

Affected products

  • Linux Linux kernel 3.10.41 to 3.11, 3.12.20 to 3.13, 3.14.5 to 5.4.290, 5.5 to 5.10.234, 5.11 to 5.15.177, 5.16 to 6.1.125, 6.2 to 6.6.72, 6.7 to 6.12.10, 6.13-rc1 to 6.13-rc6

Timeline

  • 2025-01-08: patched: Initial patch authored by Matthieu Baerts
  • 2025-01-19: disclosed: CVE published

References

Related threats