CVE-2025-21716
NoneCVSS
—
EPSS
0.2%
Published
Feb 27, 2025
CISA due date
—
Cloudanix analysis
A bug in network message handling could let attackers read private memory areas inside the system.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Information Disclosure
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Uninitialized kernel memory access in vxlan_vnifilter_dump() when netlink payload length is shorter than sizeof(struct tunnel_msg), causing reads beyond the allocated message buffer.
Why it matters to the business
Potential leakage of kernel memory contents across systems with 98 downstream dependents, increasing risk of sensitive data exposure in Linux environments using VXLAN.
How an attack unfolds
An attacker sends a crafted short netlink message via rtnetlink to the VXLAN handler; the insufficient length check leads vxlan_vnifilter_dump to access uninitialized bytes created during skb allocation.
How to fix it
Upgrade tensorflow (PyPI) to version 2.3.4; apply equivalent Linux kernel patches that enforce length checks before accessing tunnel_msg in vxlan_vnifilter_dump.
How to confirm the fix worked
Confirm package version is at tensorflow 2.3.4 or later; test with short netlink payloads to verify error return instead of uninit access.
Typical attack path
- Craft netlink message with payload shorter than sizeof(struct tunnel_msg)
- Send via rtnetlink socket using sendmsg syscall
- Trigger rtnl_dumpit path to vxlan_vnifilter_dump
- Read uninitialized kernel memory via KMSAN-detected access
How to detect it
Search system logs and KMSAN reports for uninit-value accesses in vxlan_vnifilter.c; correlate with rtnetlink_dump_start and netlink_sendmsg activity from untrusted processes.
What your security team should do
- Prioritize kernel and tensorflow updates due to 608 days since publication and related privilege escalation threats
- Monitor netlink traffic for anomalous short VXLAN messages
- Review ecosystem dependents for coordinated patching
The record
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix uninit-value in vxlan_vnifilter_dump() KMSAN reported an uninit-value access in vxlan_vnifilter_dump() [1]. If the length of the netlink message payload is less than sizeof(struct tunnel_msg), vxlan_vnifilter_dump() accesses bytes beyond the message. This can lead to uninit-value access. Fix this by returning an error in such situations. [1] BUG: KMSAN: uninit-value in vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422 vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422 rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6786 netlink_dump+0x93e/0x15f0 net/netlink/af_netlink.c:2317 __netlink_dump_start+0x716/0xd60 net/netlink/af_netlink.c:2432 netlink_dump_start include/linux/netlink.h:340 [inline] rtnetlink_dump_start net/core/rtnetlink.c:6815 [inline] rtnetlink_rcv_msg+0x1256/0x14a0 net/core/rtnetlink.c:6882 netlink_rcv_skb+0x467/0x660 net/netlink/af_netlink.c:2542 rtnetlink_rcv+0x35/0x40 net/core/rtnetlink.c:6944 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0xed6/0x1290 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x1092/0x1230 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:726 ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637 __sys_sendmsg net/socket.c:2669 [inline] __do_sys_sendmsg net/socket.c:2674 [inline] __se_sys_sendmsg net/socket.c:2672 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672 x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4110 [inline] slab_alloc_node mm/slub.c:4153 [inline] kmem_cache_alloc_node_noprof+0x800/0xe80 mm/slub.c:4205 kmalloc_reserve+0x13b/0x4b0 net/core/skbuff.c:587 __alloc_skb+0x347/0x7d0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] netlink_alloc_large_skb+0xa5/0x280 net/netlink/af_netlink.c:1196 netlink_sendmsg+0xac9/0x1230 net/netlink/af_netlink.c:1866 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:726 ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637 __sys_sendmsg net/socket.c:2669 [inline] __do_sys_sendmsg net/socket.c:2674 [inline] __se_sys_sendmsg net/socket.c:2672 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672 x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 30991 Comm: syz.4.10630 Not tainted 6.12.0-10694-gc44daa7e3c73 #29 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux-6.1 | 0 | 6.1.129-1~deb11u1 |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.13-1 |
| Linux | Kernel | 5.18.0 | 6.1.129 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_9 | 0 | 1-150600.1.3.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_9 | 0 | 1-150600.13.3.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.42.2.150600.12.18.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.31.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.31.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.31.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.29.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.29.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.29.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.29.1 |
| Ubuntu:24.10 | linux-aws | 0 | 6.11.0-1014.15 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.31.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.42.2.150600.12.18.4 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.31.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.31.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.42.2 |
Related vulnerabilities
- CVE-2025-38177 In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make… Also affects linux-6.1
- CVE-2025-38095 In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert… Also affects linux-6.1
- CVE-2025-38094 In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb… Also affects linux-6.1
- CVE-2025-38023 In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure… Also affects linux-6.1
- CVE-2025-38027 In the Linux kernel, the following vulnerability has been resolved: regulator: max20086… Also affects linux-6.1
- CVE-2025-38024 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix… Also affects linux-6.1
- CVE-2025-38015 In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix… Also affects linux-6.1
- CVE-2025-38020 In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable… Also affects linux-6.1