cve-2025-21767
Vulnerability from cvelistv5
Published
2025-02-27 02:18
Modified
2025-03-24 15:40
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context The following bug report happened with a PREEMPT_RT kernel: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 get_random_u32+0x4f/0x110 clocksource_verify_choose_cpus+0xab/0x1a0 clocksource_verify_percpu.part.0+0x6b/0x330 clocksource_watchdog_kthread+0x193/0x1a0 It is due to the fact that clocksource_verify_choose_cpus() is invoked with preemption disabled. This function invokes get_random_u32() to obtain random numbers for choosing CPUs. The batched_entropy_32 local lock and/or the base_crng.lock spinlock in driver/char/random.c will be acquired during the call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot be acquired in atomic context. Fix this problem by using migrate_disable() to allow smp_processor_id() to be reliably used without introducing atomic context. preempt_disable() is then called after clocksource_verify_choose_cpus() but before the clocksource measurement is being run to avoid introducing unexpected latency.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0fb534187d2355f6c8f995321e76d1ccd1262ac1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/60f54f0d4ea530950549a8263e6fdd70a40490a4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6bb05a33337b2c842373857b63de5c9bf1ae2a09
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/852805b6cbdb69c298a8fc9fbe79994c95106e04
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8783ceeee797d9aa9cfe150690fb9d0bac8cc459
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cc3d79e7c806cb57d71c28a4a35e7d7fb3265faa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d9c217fadfcff7a8df58567517d1e4253f3fd243
Impacted products
Vendor Product Version
Linux Linux Version: d9b40ebd448e437ffbc65f013836f98252279a82
Version: 7560c02bdffb7c52d1457fa551b9e745d4b9e754
Version: 7560c02bdffb7c52d1457fa551b9e745d4b9e754
Version: 7560c02bdffb7c52d1457fa551b9e745d4b9e754
Version: 7560c02bdffb7c52d1457fa551b9e745d4b9e754
Version: 7560c02bdffb7c52d1457fa551b9e745d4b9e754
Version: 7560c02bdffb7c52d1457fa551b9e745d4b9e754
 Create a notification for this product.
   Linux Linux Version: 5.14
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "kernel/time/clocksource.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "d9c217fadfcff7a8df58567517d1e4253f3fd243",
                     status: "affected",
                     version: "d9b40ebd448e437ffbc65f013836f98252279a82",
                     versionType: "git",
                  },
                  {
                     lessThan: "60f54f0d4ea530950549a8263e6fdd70a40490a4",
                     status: "affected",
                     version: "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
                     versionType: "git",
                  },
                  {
                     lessThan: "852805b6cbdb69c298a8fc9fbe79994c95106e04",
                     status: "affected",
                     version: "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
                     versionType: "git",
                  },
                  {
                     lessThan: "8783ceeee797d9aa9cfe150690fb9d0bac8cc459",
                     status: "affected",
                     version: "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
                     versionType: "git",
                  },
                  {
                     lessThan: "cc3d79e7c806cb57d71c28a4a35e7d7fb3265faa",
                     status: "affected",
                     version: "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
                     versionType: "git",
                  },
                  {
                     lessThan: "0fb534187d2355f6c8f995321e76d1ccd1262ac1",
                     status: "affected",
                     version: "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
                     versionType: "git",
                  },
                  {
                     lessThan: "6bb05a33337b2c842373857b63de5c9bf1ae2a09",
                     status: "affected",
                     version: "7560c02bdffb7c52d1457fa551b9e745d4b9e754",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "kernel/time/clocksource.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "5.14",
                  },
                  {
                     lessThan: "5.14",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.10.*",
                     status: "unaffected",
                     version: "5.10.235",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.179",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.129",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.79",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.12.*",
                     status: "unaffected",
                     version: "6.12.16",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.13.*",
                     status: "unaffected",
                     version: "6.13.4",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.14",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context\n\nThe following bug report happened with a PREEMPT_RT kernel:\n\n  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog\n  preempt_count: 1, expected: 0\n  RCU nest depth: 0, expected: 0\n  get_random_u32+0x4f/0x110\n  clocksource_verify_choose_cpus+0xab/0x1a0\n  clocksource_verify_percpu.part.0+0x6b/0x330\n  clocksource_watchdog_kthread+0x193/0x1a0\n\nIt is due to the fact that clocksource_verify_choose_cpus() is invoked with\npreemption disabled.  This function invokes get_random_u32() to obtain\nrandom numbers for choosing CPUs.  The batched_entropy_32 local lock and/or\nthe base_crng.lock spinlock in driver/char/random.c will be acquired during\nthe call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot\nbe acquired in atomic context.\n\nFix this problem by using migrate_disable() to allow smp_processor_id() to\nbe reliably used without introducing atomic context. preempt_disable() is\nthen called after clocksource_verify_choose_cpus() but before the\nclocksource measurement is being run to avoid introducing unexpected\nlatency.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-24T15:40:04.448Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/d9c217fadfcff7a8df58567517d1e4253f3fd243",
            },
            {
               url: "https://git.kernel.org/stable/c/60f54f0d4ea530950549a8263e6fdd70a40490a4",
            },
            {
               url: "https://git.kernel.org/stable/c/852805b6cbdb69c298a8fc9fbe79994c95106e04",
            },
            {
               url: "https://git.kernel.org/stable/c/8783ceeee797d9aa9cfe150690fb9d0bac8cc459",
            },
            {
               url: "https://git.kernel.org/stable/c/cc3d79e7c806cb57d71c28a4a35e7d7fb3265faa",
            },
            {
               url: "https://git.kernel.org/stable/c/0fb534187d2355f6c8f995321e76d1ccd1262ac1",
            },
            {
               url: "https://git.kernel.org/stable/c/6bb05a33337b2c842373857b63de5c9bf1ae2a09",
            },
         ],
         title: "clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2025-21767",
      datePublished: "2025-02-27T02:18:17.067Z",
      dateReserved: "2024-12-29T08:45:45.762Z",
      dateUpdated: "2025-03-24T15:40:04.448Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2025-21767\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T03:15:17.383\",\"lastModified\":\"2025-03-13T13:15:53.937\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context\\n\\nThe following bug report happened with a PREEMPT_RT kernel:\\n\\n  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\\n  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog\\n  preempt_count: 1, expected: 0\\n  RCU nest depth: 0, expected: 0\\n  get_random_u32+0x4f/0x110\\n  clocksource_verify_choose_cpus+0xab/0x1a0\\n  clocksource_verify_percpu.part.0+0x6b/0x330\\n  clocksource_watchdog_kthread+0x193/0x1a0\\n\\nIt is due to the fact that clocksource_verify_choose_cpus() is invoked with\\npreemption disabled.  This function invokes get_random_u32() to obtain\\nrandom numbers for choosing CPUs.  The batched_entropy_32 local lock and/or\\nthe base_crng.lock spinlock in driver/char/random.c will be acquired during\\nthe call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot\\nbe acquired in atomic context.\\n\\nFix this problem by using migrate_disable() to allow smp_processor_id() to\\nbe reliably used without introducing atomic context. preempt_disable() is\\nthen called after clocksource_verify_choose_cpus() but before the\\nclocksource measurement is being run to avoid introducing unexpected\\nlatency.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clocksource: Use migrants_disable() para evitar llamar a get_random_u32() en un contexto atómico El siguiente informe de error ocurrió con un kernel PREEMPT_RT: ERROR: función inactiva llamada desde un contexto no válido en kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog preempt_count: 1, expected: 0 Profundidad de anidamiento de RCU: 0, expected: 0 get_random_u32+0x4f/0x110 clocksource_verify_choose_cpus+0xab/0x1a0 clocksource_verify_percpu.part.0+0x6b/0x330 clocksource_watchdog_kthread+0x193/0x1a0 Esto se debe al hecho de que clocksource_verify_choose_cpus() se invoca con la preempción deshabilitada. Esta función invoca get_random_u32() para obtener números aleatorios para elegir las CPU. El bloqueo local batched_entropy_32 y/o el spinlock base_crng.lock en driver/char/random.c se adquirirán durante la llamada. En el kernel PREEMPT_RT, ambos son bloqueos inactivos y, por lo tanto, no se pueden adquirir en un contexto atómico. Solucione este problema utilizando migrants_disable() para permitir que smp_processor_id() se utilice de manera confiable sin introducir un contexto atómico. Luego, se llama a preempt_disable() después de clocksource_verify_choose_cpus() pero antes de que se ejecute la medición de la fuente de reloj para evitar introducir una latencia inesperada.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0fb534187d2355f6c8f995321e76d1ccd1262ac1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/60f54f0d4ea530950549a8263e6fdd70a40490a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6bb05a33337b2c842373857b63de5c9bf1ae2a09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/852805b6cbdb69c298a8fc9fbe79994c95106e04\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8783ceeee797d9aa9cfe150690fb9d0bac8cc459\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc3d79e7c806cb57d71c28a4a35e7d7fb3265faa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d9c217fadfcff7a8df58567517d1e4253f3fd243\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.