Executive brief
A vulnerability in the Linux kernel's multicast routing component could allow a local user to crash the system. The issue occurs when the system attempts to process certain network routing information that has not yet been fully resolved. This can lead to a system-wide denial of service or potentially allow unauthorized access to sensitive kernel memory.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in the ipmr (IP Multicast Routing) subsystem of the Linux kernel. It is caused by calling mr_mfc_uses_dev() on unresolved multicast forwarding cache (MFC) entries during a netlink route dump. Because unresolved entries use a different structure layout (aliasing pointers to sk_buff_head), the function attempts to access invalid memory addresses. A local attacker with low privileges can trigger this by requesting a multicast route dump via netlink, leading to a kernel oops/panic or potential information leakage from kernel memory. The issue has been patched by removing the invalid device filtering check for unresolved entries in net/ipv4/ipmr_base.c.
Affected products
- Linux Linux kernel 4.20 to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.76, 6.7 to 6.12.13, 6.13 to 6.13.2
Timeline
- 2025-01-21: patched: Initial fix authored by Eric Dumazet
- 2025-02-27: advisory: CVE-2025-21719 published
References
- https://git.kernel.org/stable/c/15a901361ec3fb1c393f91880e1cbf24ec0a88bd
- https://git.kernel.org/stable/c/26bb7d991f04eeef47dfad23e533834995c26f7a
- https://git.kernel.org/stable/c/53df27fd38f84bd3cd6b004eb4ff3c4903114f1d
- https://git.kernel.org/stable/c/547ef7e8cbb98f966c8719a3e15d4e078aaa9b47
- https://git.kernel.org/stable/c/57177c5f47a8da852f8d76cf6945cf803f8bb9e5
- https://git.kernel.org/stable/c/71a0fcb68c0a5f3ec912b540cd5d72148e6ee5f1
- https://git.kernel.org/stable/c/a099834a51ccf9bbba3de86a251b3433539abfde