CVE-2025-21761
Published: 27 February 2025
Summary
CVE-2025-21761 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-21761 is a use-after-free (UAF) vulnerability in the Linux kernel's Open vSwitch (OVS) implementation, specifically within the ovs_vport_cmd_fill_info() function. This function could be invoked without proper Reverse Path Network Link (RTNL) or Read-Copy Update (RCU) protection, leading to potential UAF conditions. The issue, classified under CWE-416, affects Linux kernel versions incorporating Open vSwitch and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation could result in high-impact consequences, including unauthorized access to sensitive data (high confidentiality impact), modification of kernel state (high integrity impact), and system denial of service or crashes (high availability impact), potentially elevating privileges within the kernel context.
Mitigation is available through patches applied to Linux kernel stable branches, as detailed in the referenced commits: 5828937742af74666192835d657095d95c53dbd0, 7e01abc34e87abd091e619161a20f54ed4e3e2da, 8ec57509c36c8b9a23e50b7858dda0c520a2d074, 90b2f49a502fa71090d9f4fe29a2f51fe5dff76d, and a849a10de5e04d798f7f286a2f1ca174719a617a. These commits implement RCU protection and utilize dev_net_rcu() to prevent the UAF by ensuring safe access to network device structures. Security practitioners should update affected kernel versions promptly, particularly in environments using Open vSwitch for virtual networking.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5156
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The kernel use-after-free in OVS directly enables local privilege escalation via exploitation of a memory corruption flaw with high impact on confidentiality, integrity, and availability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely remediation of identified flaws, such as applying kernel patches for the Open vSwitch UAF vulnerability in CVE-2025-21761.
Provides kernel memory protections like KASLR and non-executable memory that mitigate exploitation of the UAF in ovs_vport_cmd_fill_info().
Facilitates identification of vulnerable Linux kernel versions affected by CVE-2025-21761 through regular vulnerability scanning.