[FIPS 9.2] Multiple VULNS 28/11/25 #733

shreeya-patel98 · 2025-11-28T13:46:06Z

Commits

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
    
    jira VULN-155163
    cve CVE-2025-39817
    commit-author Li Nan <linan122@huawei.com>
    commit a6358f8cf64850f3f27857b8ed8c1b08cfc4685c


    ALSA: usb-audio: Validate UAC3 cluster segment descriptors
    
    jira VULN-152938
    cve CVE-2025-39757
    commit-author Takashi Iwai <tiwai@suse.de>
    commit ecfd41166b72b67d3bdeb88d224ff445f6163869

    ipv6: sr: Fix MAC comparison to be constant-time
    
    jira VULN-136546
    cve CVE-2025-39702
    commit-author Eric Biggers <ebiggers@kernel.org>
    commit a458b2902115b26a25d67393b12ddd57d1216aaa


    ALSA: usb-audio: Validate UAC3 power domain descriptors, too
    
    jira VULN-136374
    cve CVE-2025-38729
    commit-author Takashi Iwai <tiwai@suse.de>
    commit d832ccbc301fbd9e5a1d691bdcf461cdb514595f

    nbd: fix incomplete validation of ioctl arg
    
    jira VULN-157133
    cve CVE-2023-53513
    commit-author Zhong Jinghua <zhongjinghua@huawei.com>
    commit 55793ea54d77719a071b1ccc05a05056e3b5e009


    crypto: xts - Handle EBUSY correctly
    
    jira VULN-157048
    cve CVE-2023-53494
    commit-author Herbert Xu <herbert@gondor.apana.org.au>
    commit 51c082514c2dedf2711c99d93c196cc4eedceb40


    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()
    
    jira VULN-155869
    cve CVE-2023-53401
    commit-author Roman Gushchin <roman.gushchin@linux.dev>
    commit 3b8abb3239530c423c0b97e42af7f7e856e1ee96

    Bluetooth: Fix potential use-after-free when clear keys
    
    jira VULN-155800
    cve CVE-2023-53386
    commit-author Min Li <lm0963hack@gmail.com>
    commit 3673952cf0c6cf81b06c66a0b788abeeb02ff3ae

    crypto: seqiv - Handle EBUSY correctly
    
    jira VULN-155738
    cve CVE-2023-53373
    commit-author Herbert Xu <herbert@gondor.apana.org.au>
    commit 32e62025e5e52fbe4812ef044759de7010b15dbc

Kernel Build

/mnt/scratch/workspace/fips-9-compliant/kernel-src-tree
Skipping make mrproper
[TIMER]{MRPROPER}: 0s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95"
Making olddefconfig
#
# configuration written to .config
#
Starting Build
  SYNC    include/config/auto.conf.cmd
  DESCEND objtool
  DESCEND bpf/resolve_btfids
  CALL    scripts/atomic/check-atomics.sh
warning: generated include/linux/atomic/atomic-instrumented.h has been modified.
  CALL    scripts/checksyscalls.sh
  CHK     include/generated/compile.h
  CC      init/do_mounts.o
  CC      init/do_mounts_initrd.o
  CC      arch/x86/crypto/aesni-intel_glue.o
  HDRTEST usr/include/linux/sound.h
  HDRTEST usr/include/linux/aio_abi.h
  CC      security/selinux/hooks.o
  CC      kernel/sys.o
  CC      fs/super.o
  <--snip-->
  STRIP   /lib/modules/5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+/kernel/sound/xen/snd_xen_front.ko
  SIGN    /lib/modules/5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+/kernel/arch/x86/crypto/blowfish-x86_64.ko
  DEPMOD  /lib/modules/5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+
[TIMER]{MODULES}: 10s
Making Install
sh ./arch/x86/boot/install.sh \
	5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+ arch/x86/boot/bzImage \
	System.map "/boot"
[TIMER]{INSTALL}: 20s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+ and Index to 0
The default is /boot/loader/entries/809410938d1447fc931cf787fb714082-5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+.conf with index 0 and kernel /boot/vmlinuz-5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+
The default is /boot/loader/entries/809410938d1447fc931cf787fb714082-5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+.conf with index 0 and kernel /boot/vmlinuz-5.14.0-spatel_fips-9-compliant_5.14.0-284.30.1-cc1e7ae28a95+
Generating grub configuration file ...
Adding boot menu entry for UEFI Firmware Settings ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 0s
[TIMER]{BUILD}: 332s
[TIMER]{MODULES}: 10s
[TIMER]{INSTALL}: 20s
[TIMER]{TOTAL} 366s
Rebooting in 10 seconds

kernel-build.log

Kselftest

shreeya@spatel-dev-bom ~/c/w/fips-9-compliant> grep -a ^ok kselftest-before.log | wc -l
317
shreeya@spatel-dev-bom ~/c/w/fips-9-compliant> grep -a ^ok kselftest-after.log | wc -l
317
shreeya@spatel-dev-bom ~/c/w/fips-9-compliant>

kselftest-after.log
kselftest-before.log

jira VULN-155738 cve CVE-2023-53373 commit-author Herbert Xu <herbert@gondor.apana.org.au> commit 32e6202 As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of seqiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free. Fixes: 0a27032 ("[CRYPTO] seqiv: Add Sequence Number IV Generator") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> (cherry picked from commit 32e6202) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-155800 cve CVE-2023-53386 commit-author Min Li <lm0963hack@gmail.com> commit 3673952 Similar to commit c5d2b6f ("Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu() call. Fixes: d7d4168 ("Bluetooth: Fix Suspicious RCU usage warnings") Signed-off-by: Min Li <lm0963hack@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> (cherry picked from commit 3673952) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-155869 cve CVE-2023-53401 commit-author Roman Gushchin <roman.gushchin@linux.dev> commit 3b8abb3 KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference: ================================================================== BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock write to 0xffff888237c2a2f8 of 8 bytes by task 19625 on cpu 0: drain_obj_stock+0x408/0x4e0 mm/memcontrol.c:3306 refill_obj_stock+0x9c/0x1e0 mm/memcontrol.c:3340 obj_cgroup_uncharge+0xe/0x10 mm/memcontrol.c:3408 memcg_slab_free_hook mm/slab.h:587 [inline] __cache_free mm/slab.c:3373 [inline] __do_kmem_cache_free mm/slab.c:3577 [inline] kmem_cache_free+0x105/0x280 mm/slab.c:3602 __d_free fs/dcache.c:298 [inline] dentry_free fs/dcache.c:375 [inline] __dentry_kill+0x422/0x4a0 fs/dcache.c:621 dentry_kill+0x8d/0x1e0 dput+0x118/0x1f0 fs/dcache.c:913 __fput+0x3bf/0x570 fs/file_table.c:329 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x123/0x160 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xcf/0xe0 kernel/entry/common.c:171 exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff888237c2a2f8 of 8 bytes by task 19632 on cpu 1: obj_stock_flush_required mm/memcontrol.c:3319 [inline] drain_all_stock+0x174/0x2a0 mm/memcontrol.c:2361 try_charge_memcg+0x6d0/0xd10 mm/memcontrol.c:2703 try_charge mm/memcontrol.c:2837 [inline] mem_cgroup_charge_skmem+0x51/0x140 mm/memcontrol.c:7290 sock_reserve_memory+0xb1/0x390 net/core/sock.c:1025 sk_setsockopt+0x800/0x1e70 net/core/sock.c:1525 udp_lib_setsockopt+0x99/0x6c0 net/ipv4/udp.c:2692 udp_setsockopt+0x73/0xa0 net/ipv4/udp.c:2817 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3668 __sys_setsockopt+0x1c3/0x230 net/socket.c:2271 __do_sys_setsockopt net/socket.c:2282 [inline] __se_sys_setsockopt net/socket.c:2279 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2279 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0xffff8881382d52c0 -> 0xffff888138893740 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19632 Comm: syz-executor.0 Not tainted 6.3.0-rc2-syzkaller-00387-g534293368afa #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Fix it by using READ_ONCE()/WRITE_ONCE() for all accesses to stock->cached_objcg. Link: https://lkml.kernel.org/r/20230502160839.361544-1-roman.gushchin@linux.dev Fixes: bf4f059 ("mm: memcg/slab: obj_cgroup API") Signed-off-by: Roman Gushchin <roman.gushchin@linux.dev> Reported-by: syzbot+774c29891415ab0fd29d@syzkaller.appspotmail.com Reported-by: Dmitry Vyukov <dvyukov@google.com> Link: https://lore.kernel.org/linux-mm/CACT4Y+ZfucZhM60YPphWiCLJr6+SGFhT+jjm8k1P-a_8Kkxsjg@mail.gmail.com/T/#t Reviewed-by: Yosry Ahmed <yosryahmed@google.com> Acked-by: Shakeel Butt <shakeelb@google.com> Reviewed-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 3b8abb3) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-157048 cve CVE-2023-53494 commit-author Herbert Xu <herbert@gondor.apana.org.au> commit 51c0825 As it is xts only handles the special return value of EINPROGRESS, which means that in all other cases it will free data related to the request. However, as the caller of xts may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free. Fixes: 8083b1b ("crypto: xts - add support for ciphertext stealing") Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> (cherry picked from commit 51c0825) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-157133 cve CVE-2023-53513 commit-author Zhong Jinghua <zhongjinghua@huawei.com> commit 55793ea We tested and found an alarm caused by nbd_ioctl arg without verification. The UBSAN warning calltrace like below: UBSAN: Undefined behaviour in fs/buffer.c:1709:35 signed integer overflow: -9223372036854775808 - 1 cannot be represented in type 'long long int' CPU: 3 PID: 2523 Comm: syz-executor.0 Not tainted 4.19.90 #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x3f0 arch/arm64/kernel/time.c:78 show_stack+0x28/0x38 arch/arm64/kernel/traps.c:158 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x170/0x1dc lib/dump_stack.c:118 ubsan_epilogue+0x18/0xb4 lib/ubsan.c:161 handle_overflow+0x188/0x1dc lib/ubsan.c:192 __ubsan_handle_sub_overflow+0x34/0x44 lib/ubsan.c:206 __block_write_full_page+0x94c/0xa20 fs/buffer.c:1709 block_write_full_page+0x1f0/0x280 fs/buffer.c:2934 blkdev_writepage+0x34/0x40 fs/block_dev.c:607 __writepage+0x68/0xe8 mm/page-writeback.c:2305 write_cache_pages+0x44c/0xc70 mm/page-writeback.c:2240 generic_writepages+0xdc/0x148 mm/page-writeback.c:2329 blkdev_writepages+0x2c/0x38 fs/block_dev.c:2114 do_writepages+0xd4/0x250 mm/page-writeback.c:2344 The reason for triggering this warning is __block_write_full_page() -> i_size_read(inode) - 1 overflow. inode->i_size is assigned in __nbd_ioctl() -> nbd_set_size() -> bytesize. We think it is necessary to limit the size of arg to prevent errors. Moreover, __nbd_ioctl() -> nbd_add_socket(), arg will be cast to int. Assuming the value of arg is 0x80000000000000001) (on a 64-bit machine), it will become 1 after the coercion, which will return unexpected results. Fix it by adding checks to prevent passing in too large numbers. Signed-off-by: Zhong Jinghua <zhongjinghua@huawei.com> Reviewed-by: Yu Kuai <yukuai3@huawei.com> Reviewed-by: Josef Bacik <josef@toxicpanda.com> Link: https://lore.kernel.org/r/20230206145805.2645671-1-zhongjinghua@huawei.com Signed-off-by: Jens Axboe <axboe@kernel.dk> (cherry picked from commit 55793ea) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-136374 cve CVE-2025-38729 commit-author Takashi Iwai <tiwai@suse.de> commit d832ccb UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too. Fixes: 9a2fe9b ("ALSA: usb: initial USB Audio Device Class 3.0 support") Reported-and-tested-by: Youngjun Lee <yjjuny.lee@samsung.com> Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20250814081245.8902-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> (cherry picked from commit d832ccb) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-136546 cve CVE-2025-39702 commit-author Eric Biggers <ebiggers@kernel.org> commit a458b29 To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. Fixes: bf355b8 ("ipv6: sr: add core files for SR HMAC support") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org> Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it> Link: https://patch.msgid.link/20250818202724.15713-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit a458b29) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-136579 cve CVE-2025-39730 commit-author Trond Myklebust <trond.myklebust@hammerspace.com> commit ef93a68 The function needs to check the minimal filehandle length before it can access the embedded filehandle. Reported-by: zhangjian <zhangjian496@huawei.com> Fixes: 20fa190 ("nfs: add export operations") Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> (cherry picked from commit ef93a68) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-152938 cve CVE-2025-39757 commit-author Takashi Iwai <tiwai@suse.de> commit ecfd411 UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses. Fixes: 11785ef ("ALSA: usb-audio: Initial Power Domain support") Reported-and-tested-by: Youngjun Lee <yjjuny.lee@samsung.com> Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20250814081245.8902-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> (cherry picked from commit ecfd411) Signed-off-by: Shreeya Patel <spatel@ciq.com>

github-actions · 2025-11-28T13:58:40Z

🔍 Upstream Linux Kernel Commit Check

⚠️ PR commit 3e0e5b14d898 (ALSA: usb-audio: Validate UAC3 cluster segment descriptors) references upstream commit
ecfd41166b72 which has been referenced by a Fixes: tag in the upstream
Linux kernel:

    89f0addeee3c ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter)

This is an automated message from the kernel commit checker workflow.

jira VULN-152938 cve-bf CVE-2025-39757 commit-author Dan Carpenter <dan.carpenter@linaro.org> commit 89f0add The "p" pointer is void so sizeof(*p) is 1. The intent was to check sizeof(*cs_desc), which is 3, instead. Fixes: ecfd411 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/aKL5kftC1qGt6lpv@stanley.mountain Signed-off-by: Takashi Iwai <tiwai@suse.de> (cherry picked from commit 89f0add) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-155163 cve CVE-2025-39817 commit-author Li Nan <linan122@huawei.com> commit a6358f8 Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0 If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename: T1 T2 lookup_open ->lookup simple_lookup d_add // invalid dentry is added to hash list lookup_open d_alloc_parallel __d_lookup_rcu __d_lookup_rcu_op_compare hlist_bl_for_each_entry_rcu // invalid dentry can be retrieved ->d_compare efivarfs_d_compare // oob Fix it by checking 'guid' before cmp. Fixes: da27a24 ("efivarfs: guid part of filenames are case-insensitive") Signed-off-by: Li Nan <linan122@huawei.com> Signed-off-by: Wu Guanghao <wuguanghao3@huawei.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> (cherry picked from commit a6358f8) Signed-off-by: Shreeya Patel <spatel@ciq.com>

bmastbergen

🥌

roxanan1996 · 2025-12-04T10:37:14Z

I realize while working on CVE-2025-39702 for lts9-4.
Commit ipv6: sr: Fix MAC comparison to be constant-time
causes the build to fail for 9.4, but not for fips9-2.

eg6_hmac.c:38:10: fatal error: crypto/utils.h: No such file or directory
 6678    38 | #include <crypto/utils.h>
 6679     ¦ |

That's because this code is not compiled because
CONFIG_IPV6_SEG6_HMAC=n for fips9-2.
I'll leave this comment in case we need to enable this in the future and the build fails.

At the same time, I do not understand why this CVE had to be fixed if we don't even build that code. It feels useless.

shreeya-patel98 added 9 commits November 28, 2025 12:23

shreeya-patel98 requested a review from a team November 28, 2025 13:46

shreeya-patel98 added 2 commits November 28, 2025 14:02

shreeya-patel98 force-pushed the {spatel}_fips-9-compliant/5.14.0-284.30.1 branch from cc1e7ae to e2fb3a6 Compare November 28, 2025 14:05

roxanan1996 approved these changes Dec 1, 2025

View reviewed changes

bmastbergen self-requested a review December 1, 2025 14:44

bmastbergen approved these changes Dec 1, 2025

View reviewed changes

shreeya-patel98 merged commit 6d8936c into fips-9-compliant/5.14.0-284.30.1 Dec 1, 2025
3 checks passed

shreeya-patel98 deleted the {spatel}_fips-9-compliant/5.14.0-284.30.1 branch December 1, 2025 18:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[FIPS 9.2] Multiple VULNS 28/11/25 #733

[FIPS 9.2] Multiple VULNS 28/11/25 #733

Uh oh!

shreeya-patel98 commented Nov 28, 2025

Uh oh!

github-actions bot commented Nov 28, 2025

Uh oh!

bmastbergen left a comment

Uh oh!

Uh oh!

roxanan1996 commented Dec 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

[FIPS 9.2] Multiple VULNS 28/11/25 #733

[FIPS 9.2] Multiple VULNS 28/11/25 #733

Uh oh!

Conversation

shreeya-patel98 commented Nov 28, 2025

Commits

Kernel Build

Kselftest

Uh oh!

github-actions bot commented Nov 28, 2025

🔍 Upstream Linux Kernel Commit Check

Uh oh!

bmastbergen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

roxanan1996 commented Dec 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants