{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-21630", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.725Z", "datePublished": "2025-01-15T13:06:01.027Z", "dateUpdated": "2025-01-15T13:06:01.027Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-01-15T13:06:01.027Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: always initialize kmsg->msg.msg_inq upfront\n\nsyzbot reports that ->msg_inq may get used uinitialized from the\nfollowing path:\n\nBUG: KMSAN: uninit-value in io_recv_buf_select io_uring/net.c:1094 [inline]\nBUG: KMSAN: uninit-value in io_recv+0x930/0x1f90 io_uring/net.c:1158\n io_recv_buf_select io_uring/net.c:1094 [inline]\n io_recv+0x930/0x1f90 io_uring/net.c:1158\n io_issue_sqe+0x420/0x2130 io_uring/io_uring.c:1740\n io_queue_sqe io_uring/io_uring.c:1950 [inline]\n io_req_task_submit+0xfa/0x1d0 io_uring/io_uring.c:1374\n io_handle_tw_list+0x55f/0x5c0 io_uring/io_uring.c:1057\n tctx_task_work_run+0x109/0x3e0 io_uring/io_uring.c:1121\n tctx_task_work+0x6d/0xc0 io_uring/io_uring.c:1139\n task_work_run+0x268/0x310 kernel/task_work.c:239\n io_run_task_work+0x43a/0x4a0 io_uring/io_uring.h:343\n io_cqring_wait io_uring/io_uring.c:2527 [inline]\n __do_sys_io_uring_enter io_uring/io_uring.c:3439 [inline]\n __se_sys_io_uring_enter+0x204f/0x4ce0 io_uring/io_uring.c:3330\n __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3330\n x64_sys_call+0xce5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:427\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nand it is correct, as it's never initialized upfront. Hence the first\nsubmission can end up using it uninitialized, if the recv wasn't\nsuccessful and the networking stack didn't honor ->msg_get_inq being set\nand filling in the output value of ->msg_inq as requested.\n\nSet it to 0 upfront when it's allocated, just to silence this KMSAN\nwarning. There's no side effect of using it uninitialized, it'll just\npotentially cause the next receive to use a recv value hint that's not\naccurate."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/net.c"], "versions": [{"version": "c6f32c7d9e09bf1368447e9a29e869193ecbb756", "lessThan": "127c280067167beb88461cd930f7c7a4bb3c7239", "status": "affected", "versionType": "git"}, {"version": "c6f32c7d9e09bf1368447e9a29e869193ecbb756", "lessThan": "c6e60a0a68b7e6b3c7e33863a16e8e88ba9eee6f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/net.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.9", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13-rc6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/127c280067167beb88461cd930f7c7a4bb3c7239"}, {"url": "https://git.kernel.org/stable/c/c6e60a0a68b7e6b3c7e33863a16e8e88ba9eee6f"}], "title": "io_uring/net: always initialize kmsg->msg.msg_inq upfront", "x_generator": {"engine": "bippy-5f407fcff5a0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: always initialize kmsg->msg.msg_inq upfront\n\nsyzbot reports that ->msg_inq may get used uinitialized from the\nfollowing path:\n\nBUG: KMSAN: uninit-value in io_recv_buf_select io_uring/net.c:1094 [inline]\nBUG: KMSAN: uninit-value in io_recv+0x930/0x1f90 io_uring/net.c:1158\n io_recv_buf_select io_uring/net.c:1094 [inline]\n io_recv+0x930/0x1f90 io_uring/net.c:1158\n io_issue_sqe+0x420/0x2130 io_uring/io_uring.c:1740\n io_queue_sqe io_uring/io_uring.c:1950 [inline]\n io_req_task_submit+0xfa/0x1d0 io_uring/io_uring.c:1374\n io_handle_tw_list+0x55f/0x5c0 io_uring/io_uring.c:1057\n tctx_task_work_run+0x109/0x3e0 io_uring/io_uring.c:1121\n tctx_task_work+0x6d/0xc0 io_uring/io_uring.c:1139\n task_work_run+0x268/0x310 kernel/task_work.c:239\n io_run_task_work+0x43a/0x4a0 io_uring/io_uring.h:343\n io_cqring_wait io_uring/io_uring.c:2527 [inline]\n __do_sys_io_uring_enter io_uring/io_uring.c:3439 [inline]\n __se_sys_io_uring_enter+0x204f/0x4ce0 io_uring/io_uring.c:3330\n __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3330\n x64_sys_call+0xce5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:427\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nand it is correct, as it's never initialized upfront. Hence the first\nsubmission can end up using it uninitialized, if the recv wasn't\nsuccessful and the networking stack didn't honor ->msg_get_inq being set\nand filling in the output value of ->msg_inq as requested.\n\nSet it to 0 upfront when it's allocated, just to silence this KMSAN\nwarning. There's no side effect of using it uninitialized, it'll just\npotentially cause the next receive to use a recv value hint that's not\naccurate."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring/net: siempre inicializar kmsg->msg.msg_inq por adelantado syzbot informa que ->msg_inq puede usarse sin inicializar desde la siguiente ruta: ERROR: KMSAN: valor no inicializado en io_recv_buf_select io_uring/net.c:1094 [en l\u00ednea] ERROR: KMSAN: valor no inicializado en io_recv+0x930/0x1f90 io_uring/net.c:1158 io_recv_buf_select io_uring/net.c:1094 [en l\u00ednea] io_recv+0x930/0x1f90 io_uring/net.c:1158 io_issue_sqe+0x420/0x2130 io_uring/io_uring.c:1740 io_queue_sqe io_uring/io_uring.c:1950 [en l\u00ednea] io_req_task_submit+0xfa/0x1d0 io_uring/io_uring.c:1374 io_handle_tw_list+0x55f/0x5c0 io_uring/io_uring.c:1057 tctx_task_work_run+0x109/0x3e0 io_uring/io_uring.c:1121 tctx_task_work+0x6d/0xc0 io_uring/io_uring.c:1139 task_work_run+0x268/0x310 kernel/task_work.c:239 io_run_task_work+0x43a/0x4a0 io_uring/io_uring.h:343 io_cqring_wait io_uring/io_uring.c:2527 [en l\u00ednea] __do_sys_io_uring_enter io_uring/io_uring.c:3439 [en l\u00ednea] __se_sys_io_uring_enter+0x204f/0x4ce0 io_uring/io_uring.c:3330 __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3330 x64_sys_call+0xce5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:427 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f y es correcto, ya que nunca se inicializa por adelantado. Por lo tanto, el primer env\u00edo puede terminar us\u00e1ndolo sin inicializar, si la recepci\u00f3n no fue exitosa y la pila de red no respet\u00f3 la configuraci\u00f3n de ->msg_get_inq y no complet\u00f3 el valor de salida de ->msg_inq como se solicit\u00f3. Config\u00farelo en 0 por adelantado cuando se asigne, solo para silenciar esta advertencia de KMSAN. No hay ning\u00fan efecto secundario por usarlo sin inicializar, solo provocar\u00e1 potencialmente que la pr\u00f3xima recepci\u00f3n use una sugerencia de valor de recepci\u00f3n que no sea precisa."}], "id": "CVE-2025-21630", "lastModified": "2025-01-15T13:15:15.330", "metrics": {}, "published": "2025-01-15T13:15:15.330", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/127c280067167beb88461cd930f7c7a4bb3c7239"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c6e60a0a68b7e6b3c7e33863a16e8e88ba9eee6f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}