Re: CVE-2025-68212: fs: Fix uninitialized 'offp' in statmount_string()

[Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>]

Hi Greg,


On 16/12/25 19:27, Greg Kroah-Hartman wrote:
> From: Greg Kroah-Hartman <gregkh@kernel.org>
> 
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> fs: Fix uninitialized 'offp' in statmount_string()
> 
> In statmount_string(), most flags assign an output offset pointer (offp)
> which is later updated with the string offset. However, the
> STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP cases directly set the
> struct fields instead of using offp. This leaves offp uninitialized,
> leading to a possible uninitialized dereference when *offp is updated.
> 
> Fix it by assigning offp for UIDMAP and GIDMAP as well, keeping the code
> path consistent.
> 
> The Linux kernel CVE team has assigned CVE-2025-68212 to this issue.
> 
> 
> Affected and fixed versions
> ===========================
> 
> 	Issue introduced in 6.14 with commit e52e97f09fb66fd868260d05bd6b74a9a3db39ee and fixed in 6.17.10 with commit acfde9400e611c8d2668f1c70053c4a1d6ecfc36
> 	Issue introduced in 6.14 with commit e52e97f09fb66fd868260d05bd6b74a9a3db39ee and fixed in 6.18 with commit 0778ac7df5137d5041783fadfc201f8fd55a1d9b
> 	Issue introduced in 6.12.14 with commit d49c64c1d723c167f521833f429ab28d3ca7e0d9
> 	Issue introduced in 6.13.3 with commit c3787a4fae66e710543137b4b1b073cb2bff3bca
> 

I have reviewed the broken commit/vulnerable commit for this:

Probably the logic in scripts is to find the oldest Fixes tag if there 
are more than one Fixes' tags in the commit message:

commit 0778ac7df5137d5041783fadfc201f8fd55a1d9b
Author: Zhen Ni <zhen.ni@easystack.cn>
Date:   Mon Oct 13 19:41:51 2025 +0800

     fs: Fix uninitialized 'offp' in statmount_string()

     In statmount_string(), most flags assign an output offset pointer 
(offp)
     which is later updated with the string offset. However, the
     STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP cases directly set the
     struct fields instead of using offp. This leaves offp uninitialized,
     leading to a possible uninitialized dereference when *offp is updated.

     Fix it by assigning offp for UIDMAP and GIDMAP as well, keeping the 
code
     path consistent.

     Fixes: 37c4a9590e1e ("statmount: allow to retrieve idmappings")
     Fixes: e52e97f09fb6 ("statmount: let unset strings be empty")


For the CVE fix, the actual broken commit which is more appropriate is 
37c4a9590e1e introduces the STATMOUNT_MNT_{U,G}IDMAP cases but only
writes sm->mnt_* = start while leaving offp unset, so the shared tail of
statmount_string() later dereferences an uninitialised pointer.

Hence 37c4a9590e1e is probably the more appropriate vulnerable commit 
for this CVE.

Should I send a patch to add CVE-2025-68212.vulnerable for getting it 
updated correctly ?

Thanks,
Harshit


> Please see https://www.kernel.org for a full list of currently supported
> kernel versions by the kernel community.
> 
> Unaffected versions might change over time as fixes are backported to
> older supported kernel versions.  The official CVE entry at
> 	https://cve.org/CVERecord/?id=CVE-2025-68212
> will be updated if fixes are backported, please check that for the most
> up to date information about this issue.
> 
> 
> Affected files
> ==============
> 
> The file(s) affected by this issue are:
> 	fs/namespace.c
> 
> 
> Mitigation
> ==========
> 
> The Linux kernel CVE team recommends that you update to the latest
> stable kernel version for this, and many other bugfixes.  Individual
> changes are never tested alone, but rather are part of a larger kernel
> release.  Cherry-picking individual commits is not recommended or
> supported by the Linux kernel community at all.  If however, updating to
> the latest release is impossible, the individual changes to resolve this
> issue can be found at these commits:
> 	https://git.kernel.org/stable/c/acfde9400e611c8d2668f1c70053c4a1d6ecfc36
> 	https://git.kernel.org/stable/c/0778ac7df5137d5041783fadfc201f8fd55a1d9b
>