GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-22117 (GCVE-0-2025-22117)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:13 – Updated: 2026-08-05 11:56
VLAI
Title
ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() Fix using the untrusted value of proto->raw.pkt_len in function ice_vc_fdir_parse_raw() by verifying if it does not exceed the VIRTCHNL_MAX_SIZE_RAW_PACKET value.
Severity
8.7 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 99f419df8a5c5e1a58822203989f77712d01d410 , < 363377af2c9e874fbba3a199408f8ec7b37906f7 (git)
Affected: 99f419df8a5c5e1a58822203989f77712d01d410 , < 362f704ba73a359db9cded567e891d9a8f081875 (git)
Affected: 99f419df8a5c5e1a58822203989f77712d01d410 , < 1388dd564183a5a18ec4a966748037736b5653c5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.80 , ≤ 6.12.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "363377af2c9e874fbba3a199408f8ec7b37906f7",
              "status": "affected",
              "version": "99f419df8a5c5e1a58822203989f77712d01d410",
              "versionType": "git"
            },
            {
              "lessThan": "362f704ba73a359db9cded567e891d9a8f081875",
              "status": "affected",
              "version": "99f419df8a5c5e1a58822203989f77712d01d410",
              "versionType": "git"
            },
            {
              "lessThan": "1388dd564183a5a18ec4a966748037736b5653c5",
              "status": "affected",
              "version": "99f419df8a5c5e1a58822203989f77712d01d410",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()\n\nFix using the untrusted value of proto-\u003eraw.pkt_len in function\nice_vc_fdir_parse_raw() by verifying if it does not exceed the\nVIRTCHNL_MAX_SIZE_RAW_PACKET value."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker reaches the code by writing a crafted VIRTCHNL_OP_ADD_FDIR_FILTER message to the SR-IOV VF-to-PF mailbox, which requires local control of a VF PCI function (typically a passed-through VF inside a tenant guest VM), not network access. No remote or adjacent-network protocol can reach `ice_vc_fdir_parse_raw()`.\nAC:L - A single deterministic message with `tunnel_level=0`, `count=0`, and `raw.pkt_len=0xFFFF` triggers the 61 KB out-of-bounds read every time; there is no race, no memory-layout dependency, and the only prerequisites (FD enabled, VIRTCHNL_VF_OFFLOAD_FDIR_PF) are defaults or self-negotiated by the attacking VF.\nPR:L - The attacker needs control of the VF mailbox \u2014 i.e. root inside the guest VM or container that the host administrator deliberately handed the VF to \u2014 which is a low-privileged principal from the host kernel\u0027s security authority, with no host-side credential or capability check anywhere on the path.\nUI:N - The PF driver processes VF mailbox messages autonomously in the ice service task; no host administrator or user action is required beyond the pre-existing SR-IOV configuration.\nS:C - The ice PF driver is the isolation enforcement point between a VF and the host, so a guest-owned VF causing host kernel heap disclosure and mis-programming of the shared FDIR pipeline crosses the guest-to-host boundary and impacts the PF and all other VFs \u2014 resources outside the attacking VF\u0027s security authority.\nC:H - Up to ~61 KB of adjacent host kernel heap is read out of bounds past the 4096-byte mailbox buffer \u2014 far beyond a \"strictly bounded few bytes\" \u2014 and the leaked bytes are copied into `prof-\u003efv[].spec/msk` and the FDIR training packet programmed into hardware, giving the VF a matching-behaviour oracle to recover them.\nI:L - There is no out-of-bounds write \u2014 every downstream copy is bounded (`ICE_PARSER_MAX_PKT_LEN` clamp, `ICE_PARSER_FV_MAX` cap, `u8` `conf-\u003epkt_len`) \u2014 but the attacker does cause unintended kernel heap contents to be programmed as FDIR profiles and training packets into the shared NIC pipeline, a limited modification of host and device state affecting flow steering.\nA:H - Reading ~61 KB past a kmalloc-4096 object can walk into an unmapped direct-map page, a KFENCE guard page, or a DEBUG_PAGEALLOC/rodata_full hole and oops the host in the mailbox work context, and on KASAN builds it is a guaranteed slab-out-of-bounds splat \u2014 a crash of the host kernel and its networking."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:54.360Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/363377af2c9e874fbba3a199408f8ec7b37906f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/362f704ba73a359db9cded567e891d9a8f081875"
        },
        {
          "url": "https://git.kernel.org/stable/c/1388dd564183a5a18ec4a966748037736b5653c5"
        }
      ],
      "title": "ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22117",
    "datePublished": "2025-04-16T14:13:03.099Z",
    "dateReserved": "2024-12-29T08:45:45.823Z",
    "dateUpdated": "2026-08-05T11:56:54.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22117",
      "date": "2026-09-17",
      "epss": "0.00192",
      "percentile": "0.09124"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "363377af2c9e874fbba3a199408f8ec7b37906f7",
                    "status": "affected",
                    "version": "99f419df8a5c5e1a58822203989f77712d01d410",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "362f704ba73a359db9cded567e891d9a8f081875",
                    "status": "affected",
                    "version": "99f419df8a5c5e1a58822203989f77712d01d410",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1388dd564183a5a18ec4a966748037736b5653c5",
                    "status": "affected",
                    "version": "99f419df8a5c5e1a58822203989f77712d01d410",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.80",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.14.*",
                    "status": "unaffected",
                    "version": "6.14.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3AB78153-4A25-4D47-B073-8CD166841742",
                    "versionEndExcluding": "6.14.2",
                    "versionStartIncluding": "6.12",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()\n\nFix using the untrusted value of proto-\u003eraw.pkt_len in function\nice_vc_fdir_parse_raw() by verifying if it does not exceed the\nVIRTCHNL_MAX_SIZE_RAW_PACKET value."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: correcci\u00f3n del uso del valor no confiable de pkt_len en ice_vc_fdir_parse_raw() Se corrige el uso del valor no confiable de proto-\u0026gt;raw.pkt_len en la funci\u00f3n ice_vc_fdir_parse_raw() verificando que no exceda el valor VIRTCHNL_MAX_SIZE_RAW_PACKET."
          }
        ],
        "id": "CVE-2025-22117",
        "lastModified": "2026-07-30T06:22:15.657",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-04-16T15:16:05.900",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1388dd564183a5a18ec4a966748037736b5653c5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/362f704ba73a359db9cded567e891d9a8f081875"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/363377af2c9e874fbba3a199408f8ec7b37906f7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:12:22+00:00",
      "cve": "CVE-2025-22117",
      "id": "CVE-2025-22117",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22117.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.