Executive brief
A vulnerability in the Linux kernel's ROSE networking protocol could allow a local user to cause a system crash. The ROSE protocol is used for amateur radio packet networking. By providing unexpectedly large configuration values, an attacker can trigger an internal calculation error that disrupts system stability.
Technical details
An integer overflow vulnerability exists in net/rose/af_rose.c within the rose_setsockopt() function. The issue stems from insufficient validation of the 'opt' argument provided by userspace; when this value is multiplied by internal constants (like HZ or 60 * HZ) to set socket timeouts (T1, T2, T3, IDLE, etc.), it can wrap around. A local attacker with permissions to create ROSE sockets can exploit this to set invalid timer values, potentially leading to kernel instability or a denial of service. The fix introduces bounds checking against UINT_MAX / HZ and switches the variable type to unsigned int to prevent signed integer issues.
Affected products
- Linux Linux Kernel 2.6.12 to 6.1.129, 6.2 to 6.6.76, 6.7 to 6.12.13, 6.13 to 6.13.2
Timeline
- 2025-01-15: other: Patch submitted by Nikita Zhandarovich
- 2025-02-26: disclosed: CVE assigned and published by kernel.org
- 2025-02-27: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/352daa50946c3bbb662432e8daf54d6760796589
- https://git.kernel.org/stable/c/4bdd449977e2364a53d0b2a5427e71beb1cd702d
- https://git.kernel.org/stable/c/9bdee49ad6bbd26ab5e13cc6731e54fb1b6c1dca
- https://git.kernel.org/stable/c/b8583b54455cbec2fc038fa32b6700890b369815
- https://git.kernel.org/stable/c/d08f4074f9c69f7e95502587eb1b258a965ba7f0
- https://git.kernel.org/stable/c/d640627663bfe7d8963c7615316d7d4ef60f3b0b
- https://git.kernel.org/stable/c/e5338930a29d0ab2a5af402f5f664aeba0d1a676