{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21924","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.788Z","datePublished":"2025-04-01T15:40:56.841Z","dateUpdated":"2026-08-05T11:55:22.940Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:55:22.940Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error\n\nDuring the initialization of ptp, hclge_ptp_get_cycle might return an error\nand returned directly without unregister clock and free it. To avoid that,\ncall hclge_ptp_destroy_clock to unregist and free clock if\nhclge_ptp_get_cycle failed."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access to the stale PTP clock left behind — reading world-readable `/sys/class/ptp/ptpN/clock_name` or issuing ioctls/clock_adjtime on `/dev/ptpN`; no network traffic reaches this code.\nAC:L - On an affected platform the dangling `ptp_clock` is created deterministically on every failed probe/reset with no race to win and no memory-layout precondition, so the attacker can dereference the freed `ptp_clock_info` at will.\nPR:L - The PTP sysfs attributes that dereference the freed `ptp->info` (`clock_name`, `max_adjustment`, `n_*`) are mode 0444, so any unprivileged local account can trigger the use-after-free; `/dev/ptpN` widens this further where PTP daemons/containers are granted access.\nUI:N - The dangling registration is created by driver probe or device reset at boot; the attacker acts alone and needs no victim to perform any action.\nS:U - The freed devm slab object and the PTP core both reside in the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free of the `hclge_ptp` object leaks reallocated slab contents through `sysfs_emit(\"%s\", ptp->info->name)`, and `hclge_ptp_gettimex()` returns `readl()` from an `io_base` taken from the freed object, yielding an attacker-directed read primitive.\nI:H - `hclge_ptp_settime()`/`adjtime()`/`adjfine()` perform `writel(attacker_value, hdev->ptp->io_base + off)` with both value and address sourced from the freed allocation, giving an arbitrary-write primitive once the slab is groomed, plus dangling function pointers in `ptp_clock_info` for control-flow hijack.\nA:H - Any access to the orphaned PTP clock dereferences freed memory (and unmapped MMIO after `pcim_iounmap`), reliably producing an oops or panic; the reset path additionally leaves `cycle.den == 0` reachable by `div_u64_rem()`."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c"],"versions":[{"version":"8373cd38a8888549ace7c7617163a2e826970a92","lessThan":"b7d8d4529984e2d4a72a6d552fb886233e8e83cb","status":"affected","versionType":"git"},{"version":"8373cd38a8888549ace7c7617163a2e826970a92","lessThan":"33244e98aa9503585e585335fe2ceb4492630949","status":"affected","versionType":"git"},{"version":"8373cd38a8888549ace7c7617163a2e826970a92","lessThan":"2c04e507f3a5c5dc6e2b9ab37d8cdedee1ef1a37","status":"affected","versionType":"git"},{"version":"8373cd38a8888549ace7c7617163a2e826970a92","lessThan":"9cfc43c0e6e6a31122b4008d763a2960c206aa2d","status":"affected","versionType":"git"},{"version":"8373cd38a8888549ace7c7617163a2e826970a92","lessThan":"21dba813d9821687a7f9aff576798ba21a859a32","status":"affected","versionType":"git"},{"version":"8373cd38a8888549ace7c7617163a2e826970a92","lessThan":"b7365eab39831487a84e63a9638209b68dc54008","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c"],"versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","status":"unaffected","versionType":"semver"},{"version":"5.15.179","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.131","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.83","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.19","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.7","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"5.15.179"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.1.131"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.6.83"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.12.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.13.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/b7d8d4529984e2d4a72a6d552fb886233e8e83cb"},{"url":"https://git.kernel.org/stable/c/33244e98aa9503585e585335fe2ceb4492630949"},{"url":"https://git.kernel.org/stable/c/2c04e507f3a5c5dc6e2b9ab37d8cdedee1ef1a37"},{"url":"https://git.kernel.org/stable/c/9cfc43c0e6e6a31122b4008d763a2960c206aa2d"},{"url":"https://git.kernel.org/stable/c/21dba813d9821687a7f9aff576798ba21a859a32"},{"url":"https://git.kernel.org/stable/c/b7365eab39831487a84e63a9638209b68dc54008"}],"title":"net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T19:39:17.991Z"}}]}}