logo_clicknbuy.png

CVE-2025-21650 – “Huawei Hns3 Overwrite Vulnerability”

The following table lists the changes that have been made to the
CVE-2025-21650 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jan. 19, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved:

    net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue

    The TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs
    1024-1279 are in different BAR space addresses. However,
    hclge_fetch_pf_reg does not distinguish the tqp space information when
    reading the tqp space information. When the number of TQPs is greater
    than 1024, access bar space overwriting occurs.
    The problem of different segments has been considered during the
    initialization of tqp.io_base. Therefore, tqp.io_base is directly used
    when the queue is read in hclge_fetch_pf_reg.

    The error message:

    Unable to handle kernel paging request at virtual address ffff800037200000
    pc : hclge_fetch_pf_reg+0x138/0x250 [hclge]
    lr : hclge_get_regs+0x84/0x1d0 [hclge]
    Call trace:
    hclge_fetch_pf_reg+0x138/0x250 [hclge]
    hclge_get_regs+0x84/0x1d0 [hclge]
    hns3_get_regs+0x2c/0x50 [hns3]
    ethtool_get_regs+0xf4/0x270
    dev_ethtool+0x674/0x8a0
    dev_ioctl+0x270/0x36c
    sock_do_ioctl+0x110/0x2a0
    sock_ioctl+0x2ac/0x530
    __arm64_sys_ioctl+0xa8/0x100
    invoke_syscall+0x4c/0x124
    el0_svc_common.constprop.0+0x140/0x15c
    do_el0_svc+0x30/0xd0
    el0_svc+0x1c/0x2c
    el0_sync_handler+0xb0/0xb4
    el0_sync+0x168/0x180
    Added Reference https://git.kernel.org/stable/c/0575baa733fc4219f230aef22d5bc35d922f1e9a
    Added Reference https://git.kernel.org/stable/c/7997ddd46c54408bcba5e37fe18b4d832e45d4d4
Share the Post:

Related Posts