{"uuid": "3d016b55-4191-4761-8c39-3db615e3876c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-21677", "type": "seen", "source": "https://t.me/cvedetector/16949", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-21677 - Vulnerability Title: Linux pfcp Newlink devices Remote Reference Leak\", \n  \"Content\": \"CVE ID : CVE-2025-21677 \nPublished : Jan. 31, 2025, 12:15 p.m. | 1\u00a0hour, 34\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \npfcp: Destroy device along with udp socket's netns dismantle.  \n  \npfcp_newlink() links the device to a list in dev_net(dev) instead  \nof net, where a udp tunnel socket is created.  \n  \nEven when net is removed, the device stays alive on dev_net(dev).  \nThen, removing net triggers the splat below. [0]  \n  \nIn this example, pfcp0 is created in ns2, but the udp socket is  \ncreated in ns1.  \n  \n  ip netns add ns1  \n  ip netns add ns2  \n  ip -n ns1 link add netns ns2 name pfcp0 type pfcp  \n  ip netns del ns1  \n  \nLet's link the device to the socket's netns instead.  \n  \nNow, pfcp_net_exit() needs another netdev iteration to remove  \nall pfcp devices in the netns.  \n  \npfcp_dev_list is not used under RCU, so the list API is converted  \nto the non-RCU variant.  \n  \npfcp_net_exit() can be converted to .exit_batch_rtnl() in net-next.  \n  \n[0]:  \nref_tracker: net notrefcnt@00000000128b34dc has 1/1 users at  \n     sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236)  \n     inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252)  \n     __sock_create (net/socket.c:1558)  \n     udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18)  \n     pfcp_create_sock (drivers/net/pfcp.c:168)  \n     pfcp_newlink (drivers/net/pfcp.c:182 drivers/net/pfcp.c:197)  \n     rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012)  \n     rtnetlink_rcv_msg (net/core/rtnetlink.c:6922)  \n     netlink_rcv_skb (net/netlink/af_netlink.c:2542)  \n     netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347)  \n     netlink_sendmsg (net/netlink/af_netlink.c:1891)  \n     ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583)  \n     ___sys_sendmsg (net/socket.c:2639)  \n     __sys_sendmsg (net/socket.c:2669)  \n     do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)  \n     entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)  \n  \nWARNING: CPU: 1 PID: 11 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179)  \nModules linked in:  \nCPU: 1 UID: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5  \nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014  \nWorkqueue: netns cleanup_net  \nRIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179)  \nCode: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 <0f0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89  \nRSP: 0018:ff11000007f3fb60 EFLAGS: 00010286  \nRAX: 00000000000020ef RBX: ff1100000d6481e0 RCX: 1ffffffff0e40d82  \nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c  \nRBP: ff1100000d648230 R08: 0000000000000001 R09: fffffbfff0e395af  \nR10: 0000000000000001 R11: 0000000000000000 R12: ff1100000d648230  \nR13: dead000000000100 R14: ff1100000d648230 R15: dffffc0000000000  \nFS:  0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000  \nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  \nCR2: 00005620e1363990 CR3: 000000000eeb2002 CR4: 0000000000771ef0  \nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000  \nDR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400  \nPKRU: 55555554  \nCall Trace:  \n   \n ? __warn (kernel/panic.c:748)  \n ? ref_tracker_dir_exit (lib/ref_tracker.c:179)  \n ? report_bug (lib/bug.c:201 lib/bug.c:219)  \n ? handle_bug (arch/x86/kernel/traps.c:285)  \n ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1))  \n ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621)  \n ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/a[...]", "creation_timestamp": "2025-01-31T15:22:49.000000Z"}