Junglewise Threat Intelligence

CVE-2025-21653: Linux Kernel undefined behavior in cls_flow classifier

CVE-2025-21653 · Severity: medium · CVSS 5.5 · Published 2025-01-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's network traffic control system, which manages how data packets are prioritized and routed. An attacker with local access could provide a specially crafted configuration value that causes the system to perform an invalid mathematical operation. This can lead to a system crash or instability, potentially resulting in a denial of service for the affected machine.

Technical details

A shift-out-of-bounds vulnerability was identified in net/sched/cls_flow.c within the Linux kernel's traffic control (tc) subsystem. The root cause is a lack of validation for the TCA_FLOW_RSHIFT attribute in the flow_policy. When a user provides a shift exponent larger than the bit-width of the target 32-bit integer (u32), it triggers undefined behavior during flow classification. This was detected by syzbot using UBSAN. An attacker with local privileges to configure network schedulers could exploit this to cause a kernel panic or denial of service. The fix introduces NLA_POLICY_MAX to restrict the TCA_FLOW_RSHIFT value to a maximum of 31.

Affected products

  • Linux Linux Kernel 2.6.25 to 5.4.290, 5.5 to 5.10.234, 5.11 to 5.15.177, 5.16 to 6.1.125, 6.2 to 6.6.72, 6.7 to 6.12.10, 6.13-rc1 to 6.13-rc6

Timeline

  • 2025-01-03: patched: Initial patch submitted by Eric Dumazet
  • 2025-01-19: disclosed: CVE-2025-21653 published

References

Related threats