Cloudanix VulnDB

CVE-2025-21649

None

CVSS

—

EPSS

0.2%

Published

Jan 19, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain network cards can crash the entire computer when the system tries to send network traffic that needs precise timing.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in hclge_ptp_set_tx_info when SKBTX_HW_TSTAMP flag is set on transmit path for HIP08 devices where hdev->ptp remains unregistered.

Why it matters to the business

Kernel crashes during routine network transmission on affected hardware cause unplanned downtime, service interruption, and require system reboots to recover.

How an attack unfolds

An attacker sends network packets (commonly via UDP) that reach the hns3 transmit path with the hardware timestamp flag enabled, triggering the NULL dereference in the PTP set-info routine and resulting in a kernel panic.

How to fix it

Apply the kernel fix that prevents setting hardware timestamp info when ptp is NULL; reboot affected systems after update.

How to confirm the fix worked

Confirm the hns3 driver no longer calls hclge_ptp_set_tx_info on unregistered PTP devices; verify no NULL dereference occurs on transmit with timestamp flag.

Typical attack path

  1. Locate systems using HIP08 network devices running vulnerable hns3 driver
  2. Craft or replay traffic that sets SKBTX_HW_TSTAMP in the skb
  3. Deliver packet through normal network stack (including OVS paths)
  4. Trigger hclge_ptp_set_tx_info call leading to NULL dereference

How to detect it

Search kernel logs for NULL pointer dereference at hclge_ptp_set_tx_info or call traces involving hns3_nic_net_xmit and ovs_vport_send; inspect for repeated panics on transmit paths.

  • hclge_ptp_set_tx_info+0x2c/0x140
  • Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018

What your security team should do

  • Prioritize kernel updates on all HIP08-based systems
  • Monitor for kernel oops or panic logs containing hclge_ptp_set_tx_info
  • Temporarily disable PTP or hardware timestamping features if patches cannot be applied immediately

The record

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Currently, HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL. But the tx process would still try to set hardware time stamp info with SKBTX_HW_TSTAMP flag and cause a kernel crash. [ 128.087798] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 ... [ 128.280251] pc : hclge_ptp_set_tx_info+0x2c/0x140 [hclge] [ 128.286600] lr : hclge_ptp_set_tx_info+0x20/0x140 [hclge] [ 128.292938] sp : ffff800059b93140 [ 128.297200] x29: ffff800059b93140 x28: 0000000000003280 [ 128.303455] x27: ffff800020d48280 x26: ffff0cb9dc814080 [ 128.309715] x25: ffff0cb9cde93fa0 x24: 0000000000000001 [ 128.315969] x23: 0000000000000000 x22: 0000000000000194 [ 128.322219] x21: ffff0cd94f986000 x20: 0000000000000000 [ 128.328462] x19: ffff0cb9d2a166c0 x18: 0000000000000000 [ 128.334698] x17: 0000000000000000 x16: ffffcf1fc523ed24 [ 128.340934] x15: 0000ffffd530a518 x14: 0000000000000000 [ 128.347162] x13: ffff0cd6bdb31310 x12: 0000000000000368 [ 128.353388] x11: ffff0cb9cfbc7070 x10: ffff2cf55dd11e02 [ 128.359606] x9 : ffffcf1f85a212b4 x8 : ffff0cd7cf27dab0 [ 128.365831] x7 : 0000000000000a20 x6 : ffff0cd7cf27d000 [ 128.372040] x5 : 0000000000000000 x4 : 000000000000ffff [ 128.378243] x3 : 0000000000000400 x2 : ffffcf1f85a21294 [ 128.384437] x1 : ffff0cb9db520080 x0 : ffff0cb9db500080 [ 128.390626] Call trace: [ 128.393964] hclge_ptp_set_tx_info+0x2c/0x140 [hclge] [ 128.399893] hns3_nic_net_xmit+0x39c/0x4c4 [hns3] [ 128.405468] xmit_one.constprop.0+0xc4/0x200 [ 128.410600] dev_hard_start_xmit+0x54/0xf0 [ 128.415556] sch_direct_xmit+0xe8/0x634 [ 128.420246] __dev_queue_xmit+0x224/0xc70 [ 128.425101] dev_queue_xmit+0x1c/0x40 [ 128.429608] ovs_vport_send+0xac/0x1a0 [openvswitch] [ 128.435409] do_output+0x60/0x17c [openvswitch] [ 128.440770] do_execute_actions+0x898/0x8c4 [openvswitch] [ 128.446993] ovs_execute_actions+0x64/0xf0 [openvswitch] [ 128.453129] ovs_dp_process_packet+0xa0/0x224 [openvswitch] [ 128.459530] ovs_vport_receive+0x7c/0xfc [openvswitch] [ 128.465497] internal_dev_xmit+0x34/0xb0 [openvswitch] [ 128.471460] xmit_one.constprop.0+0xc4/0x200 [ 128.476561] dev_hard_start_xmit+0x54/0xf0 [ 128.481489] __dev_queue_xmit+0x968/0xc70 [ 128.486330] dev_queue_xmit+0x1c/0x40 [ 128.490856] ip_finish_output2+0x250/0x570 [ 128.495810] __ip_finish_output+0x170/0x1e0 [ 128.500832] ip_finish_output+0x3c/0xf0 [ 128.505504] ip_output+0xbc/0x160 [ 128.509654] ip_send_skb+0x58/0xd4 [ 128.513892] udp_send_skb+0x12c/0x354 [ 128.518387] udp_sendmsg+0x7a8/0x9c0 [ 128.522793] inet_sendmsg+0x4c/0x8c [ 128.527116] __sock_sendmsg+0x48/0x80 [ 128.531609] __sys_sendto+0x124/0x164 [ 128.536099] __arm64_sys_sendto+0x30/0x5c [ 128.540935] invoke_syscall+0x50/0x130 [ 128.545508] el0_svc_common.constprop.0+0x10c/0x124 [ 128.551205] do_el0_svc+0x34/0xdc [ 128.555347] el0_svc+0x20/0x30 [ 128.559227] el0_sync_handler+0xb8/0xc0 [ 128.563883] el0_sync+0x160/0x180

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 linux 0 No fix
Debian:13 linux 0 No fix
Debian:13 linux 0 6.12.10-1
Linux Kernel 5.14.0 6.12.10
SUSE:Linux Enterprise High Availability Extension 15 SP6 kernel-default 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-default 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_8 0 1-150600.1.3.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_8 0 1-150600.13.3.2
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-64kb 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default-base 0 6.4.0-150600.23.38.1.150600.12.16.2
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-source 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-zfcpdump 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-coco 0 6.4.0-15061.12.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-coco_debug 0 6.4.0-15061.12.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-source-coco 0 6.4.0-15061.12.coco15sp6.1
SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 kernel-syms-coco 0 6.4.0-15061.12.coco15sp6.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-docs 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-obs-build 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-source 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-syms 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Legacy 15 SP6 kernel-default 0 6.4.0-150600.23.38.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-azure 0 6.4.0-150600.8.26.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure 0 6.4.0-150600.8.26.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-syms-azure 0 6.4.0-150600.8.26.1
SUSE:Linux Enterprise Workstation Extension 15 SP6 kernel-default 0 6.4.0-150600.23.38.1
SUSE:Real Time Module 15 SP6 kernel-rt 0 6.4.0-150600.10.26.1
SUSE:Real Time Module 15 SP6 kernel-rt_debug 0 6.4.0-150600.10.26.1
SUSE:Real Time Module 15 SP6 kernel-source-rt 0 6.4.0-150600.10.26.1
SUSE:Real Time Module 15 SP6 kernel-syms-rt 0 6.4.0-150600.10.26.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 No fix
Ubuntu:20.04:LTS linux-aws 0 No fix
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 No fix
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 No fix
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 No fix
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 No fix
Ubuntu:20.04:LTS linux-gcp 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 No fix
Ubuntu:20.04:LTS linux-ibm-5.15 0 No fix
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 No fix
Ubuntu:20.04:LTS linux-iot 0 No fix
Ubuntu:20.04:LTS linux-kvm 0 No fix
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 No fix
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:22.04:LTS linux 0 No fix
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 No fix
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1029.31~22.04.1
Ubuntu:22.04:LTS linux-azure 0 No fix
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1029.34~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 No fix
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1030.32~22.04.1
Ubuntu:22.04:LTS linux-gke 0 No fix
Ubuntu:22.04:LTS linux-gkeop 0 No fix
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-60.63~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 No fix
Ubuntu:22.04:LTS linux-ibm-6.8 0 6.8.0-1026.26~22.04.1
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iotg 0 No fix
Ubuntu:22.04:LTS linux-kvm 0 No fix
Ubuntu:22.04:LTS linux-lowlatency 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-60.63.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.8 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1028.31~22.04.1
Ubuntu:22.04:LTS linux-nvidia-tegra 0 No fix
Ubuntu:22.04:LTS linux-nvidia-tegra-igx 0 No fix
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.8 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.8 0 6.8.0-1026.27~22.04.1
Ubuntu:22.04:LTS linux-raspi 0 No fix
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 6.8.0-62.65~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 No fix
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:22.04:LTS:for:NVIDIA:BlueField linux-bluefield 0 No fix
Ubuntu:24.04:LTS linux 0 No fix
Ubuntu:24.04:LTS linux 0 6.8.0-60.63
Ubuntu:24.04:LTS linux-aws 0 No fix
Ubuntu:24.04:LTS linux-aws 0 6.8.0-1029.31
Ubuntu:24.04:LTS linux-azure 0 No fix
Ubuntu:24.04:LTS linux-azure 0 6.8.0-1029.34
Ubuntu:24.04:LTS linux-azure-6.11 0 6.11.0-1012.12~24.04.1
Ubuntu:24.04:LTS linux-azure-fde 0 No fix
Ubuntu:24.04:LTS linux-azure-nvidia 0 6.8.0-1016.17
Ubuntu:24.04:LTS linux-gcp 0 No fix
Ubuntu:24.04:LTS linux-gcp 0 6.8.0-1030.32
Ubuntu:24.04:LTS linux-gcp-6.11 0 6.11.0-1011.11~24.04.1
Ubuntu:24.04:LTS linux-gke 0 No fix
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1025.29
Ubuntu:24.04:LTS linux-gkeop 0 No fix
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1012.14
Ubuntu:24.04:LTS linux-hwe-6.11 0 6.11.0-21.21~24.04.1
Ubuntu:24.04:LTS linux-ibm 0 No fix
Ubuntu:24.04:LTS linux-ibm 0 6.8.0-1026.26
Ubuntu:24.04:LTS linux-lowlatency 0 No fix
Ubuntu:24.04:LTS linux-lowlatency 0 6.8.0-60.63.1
Ubuntu:24.04:LTS linux-nvidia 0 No fix
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1028.31
Ubuntu:24.04:LTS linux-nvidia-6.11 0 6.11.0-1007.7
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 No fix
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1028.31.1
Ubuntu:24.04:LTS linux-nvidia-tegra 0 No fix
Ubuntu:24.04:LTS linux-nvidia-tegra 0 6.8.0-1008.8
Ubuntu:24.04:LTS linux-oem-6.11 0 No fix
Ubuntu:24.04:LTS linux-oem-6.11 0 6.11.0-1017.17
Ubuntu:24.04:LTS linux-oem-6.8 0 No fix
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1028.28
Ubuntu:24.04:LTS linux-oracle 0 No fix
Ubuntu:24.04:LTS linux-oracle 0 6.8.0-1026.27
Ubuntu:24.04:LTS linux-raspi 0 No fix
Ubuntu:24.04:LTS linux-raspi 0 6.8.0-1028.32

Related vulnerabilities