CVE-2025-39797

{"id": "CVE-2025-39797", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39797", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:11:40.818580Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "fb58962aa3b9359988c7b5b15a971fd9ad5b0ecd", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "3d8090bb53424432fa788fe9a49e8ceca74f0544", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2fc5b54368a1bf1d2d74b4d3b8eea5309a653e38", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "c67d4e7a8f90fb6361ca89d4d5c9a28f4e935e47", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "29e9158f91f99057dbd35db5e8674d93b38549fe", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "94f39804d891cffe4ce17737d295f3b195bc7299", "versionType": "git"}], "programFiles": ["net/xfrm/xfrm_state.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.103", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.43", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.11", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16.2", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/xfrm/xfrm_state.c"], "defaultStatus": "affected"}]}], "published": "2025-09-12T16:15:34.137", "references": [{"url": "https://git.kernel.org/stable/c/29e9158f91f99057dbd35db5e8674d93b38549fe", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2fc5b54368a1bf1d2d74b4d3b8eea5309a653e38", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3d8090bb53424432fa788fe9a49e8ceca74f0544", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/94f39804d891cffe4ce17737d295f3b195bc7299", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c67d4e7a8f90fb6361ca89d4d5c9a28f4e935e47", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fb58962aa3b9359988c7b5b15a971fd9ad5b0ecd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Duplicate SPI Handling\n\nThe issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI\nNetlink message, which triggers the kernel function xfrm_alloc_spi().\nThis function is expected to ensure uniqueness of the Security Parameter\nIndex (SPI) for inbound Security Associations (SAs). However, it can\nreturn success even when the requested SPI is already in use, leading\nto duplicate SPIs assigned to multiple inbound SAs, differentiated\nonly by their destination addresses.\n\nThis behavior causes inconsistencies during SPI lookups for inbound packets.\nSince the lookup may return an arbitrary SA among those with the same SPI,\npacket processing can fail, resulting in packet drops.\n\nAccording to RFC 4301 section 4.4.2 , for inbound processing a unicast SA\nis uniquely identified by the SPI and optionally protocol.\n\nReproducing the Issue Reliably:\nTo consistently reproduce the problem, restrict the available SPI range in\ncharon.conf : spi_min = 0x10000000 spi_max = 0x10000002\nThis limits the system to only 2 usable SPI values.\nNext, create more than 2 Child SA. each using unique pair of src/dst address.\nAs soon as the 3rd Child SA is initiated, it will be assigned a duplicate\nSPI, since the SPI pool is already exhausted.\nWith a narrow SPI range, the issue is consistently reproducible.\nWith a broader/default range, it becomes rare and unpredictable.\n\nCurrent implementation:\nxfrm_spi_hash() lookup function computes hash using daddr, proto, and family.\nSo if two SAs have the same SPI but different destination addresses, then\nthey will:\na. Hash into different buckets\nb. Be stored in different linked lists (byspi + h)\nc. Not be seen in the same hlist_for_each_entry_rcu() iteration.\nAs a result, the lookup will result in NULL and kernel allows that Duplicate SPI\n\nProposed Change:\nxfrm_state_lookup_spi_proto() does a truly global search - across all states,\nregardless of hash bucket and matches SPI and proto."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: Manejo de SPI Duplicado\n\nEl problema se origina cuando Strongswan inicia un mensaje Netlink XFRM_MSG_ALLOCSPI, lo que activa la funci\u00f3n del kernel xfrm_alloc_spi(). Se espera que esta funci\u00f3n garantice la unicidad del \u00cdndice de Par\u00e1metros de Seguridad (SPI) para las Asociaciones de Seguridad (SA) entrantes. Sin embargo, puede devolver \u00e9xito incluso cuando el SPI solicitado ya est\u00e1 en uso, lo que lleva a SPI duplicados asignados a m\u00faltiples SA entrantes, diferenciadas solo por sus direcciones de destino.\n\nEste comportamiento causa inconsistencias durante las b\u00fasquedas de SPI para paquetes entrantes. Dado que la b\u00fasqueda puede devolver una SA arbitraria entre aquellas con el mismo SPI, el procesamiento de paquetes puede fallar, lo que resulta en la p\u00e9rdida de paquetes.\n\nSeg\u00fan la secci\u00f3n 4.4.2 de RFC 4301, para el procesamiento entrante, una SA unicast se identifica de forma \u00fanica por el SPI y, opcionalmente, el protocolo.\n\nReproducci\u00f3n Confiable del Problema:\nPara reproducir consistentemente el problema, restrinja el rango de SPI disponible en charon.conf: spi_min = 0x10000000 spi_max = 0x10000002\nEsto limita el sistema a solo 2 valores de SPI utilizables.\nA continuaci\u00f3n, cree m\u00e1s de 2 SA secundarias (Child SA), cada una utilizando un par \u00fanico de direcciones src/dst.\nTan pronto como se inicie la tercera SA secundaria (Child SA), se le asignar\u00e1 un SPI duplicado, ya que el grupo de SPI ya est\u00e1 agotado.\nCon un rango de SPI estrecho, el problema es consistentemente reproducible.\nCon un rango m\u00e1s amplio/predeterminado, se vuelve raro e impredecible.\n\nImplementaci\u00f3n actual:\nLa funci\u00f3n de b\u00fasqueda xfrm_spi_hash() calcula el hash usando daddr, proto y family.\nEntonces, si dos SA tienen el mismo SPI pero diferentes direcciones de destino, entonces:\na. Se dispersar\u00e1n en diferentes cubos\nb. Se almacenar\u00e1n en diferentes listas enlazadas (byspi + h)\nc. No se ver\u00e1n en la misma iteraci\u00f3n de hlist_for_each_entry_rcu().\nComo resultado, la b\u00fasqueda dar\u00e1 como resultado NULL y el kernel permite ese SPI duplicado.\n\nCambio Propuesto:\nxfrm_state_lookup_spi_proto() realiza una b\u00fasqueda verdaderamente global, a trav\u00e9s de todos los estados, independientemente del cubo de hash y coincide con el SPI y el protocolo."}], "lastModified": "2026-11-05T22:17:32.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC0A252C-F6BD-41C1-A461-AD2D5B2E915E", "versionEndExcluding": "6.6.103"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "472C5F87-2BF3-4FAB-9B21-DA7513977363", "versionEndExcluding": "6.12.43", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977", "versionEndExcluding": "6.15.11", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899", "versionEndExcluding": "6.16.2", "versionStartIncluding": "6.16"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}