CVE-2025-21715
Published: 27 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private data and it cannot be used after free_netdev() call. Using dm after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function. This is similar to the issue fixed in commit ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove"). This bug is detected by our static analysis tool.
Security Summary
CVE-2025-21715 is a use-after-free (UAF) vulnerability in the Linux kernel's davicom network driver, specifically within the dm9000_drv_remove function. The issue arises because the netdev private data structure 'dm' is accessed after the free_netdev() call, leading to potential UAF conditions. This flaw, classified under CWE-416, affects systems using the dm9000 driver and was assigned a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, such as arbitrary code execution or system crashes on affected kernel instances.
Mitigation involves applying the upstream patches from the Linux kernel stable repository, as detailed in the referenced commits (e.g., https://git.kernel.org/stable/c/19e65c45a1507a1a2926649d2db3583ed9d55fd9 and others). The fix repositions the free_netdev() call to the end of dm9000_drv_remove to prevent post-free usage of 'dm', similar to a prior resolution in the qcom/emac driver. The bug was identified via static analysis tools.
Details
- CWE(s)