CVE-2019-25045

Published: Jun 7, 2021Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46.

Affected (22)

Products: Linux: Linux Kernel · Netapp: Solidfire Baseboard Management Controller Firmware, Cloud Backup, Solidfire & Hci Management Node, H500s Firmware, H700s Firmware, H300e Firmware, H500e Firmware, H700e Firmware, H410s Firmware, H410c Firmware, H610c Firmware, H610s Firmware, H615c Firmware, H300s Firmware, Fas 8300 Firmware, Fas 8700 Firmware, Aff 8300 Firmware, Aff 8700 Firmware, Aff A400 Firmware, Fabric Attached Storage A400 Firmware, Aff A700s Firmware

Linux

1 product

Linux Kernel

Netapp

21 products

Solidfire Baseboard Management Controller Firmware

Cloud Backup

Solidfire & Hci Management Node

Fabric Attached Storage A400 Firmware

Aff A700s Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 5.0.19

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Solidfire Baseboard Management Controller Firmware	All versions

Running on/with	Platform Versions
Netapp Solidfire Baseboard Management Controller	All versions

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Solidfire & Hci Management Node	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300e Firmware	All versions

Running on/with	Platform Versions
Netapp H300e	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500e Firmware	All versions

Running on/with	Platform Versions
Netapp H500e	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700e Firmware	All versions

Running on/with	Platform Versions
Netapp H700e	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610c Firmware	All versions

Running on/with	Platform Versions
Netapp H610c	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610s Firmware	All versions

Running on/with	Platform Versions
Netapp H610s	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H615c Firmware	All versions

Running on/with	Platform Versions
Netapp H615c	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas 8300 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas 8300	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas 8700 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas 8700	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Aff 8300 Firmware	All versions

Running on/with	Platform Versions
Netapp Aff 8300	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Aff 8700 Firmware	All versions

Running on/with	Platform Versions
Netapp Aff 8700	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Aff A400 Firmware	All versions

Running on/with	Platform Versions
Netapp Aff A400	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fabric Attached Storage A400 Firmware	All versions

Running on/with	Platform Versions
Netapp Fabric Attached Storage A400	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Aff A700s Firmware	All versions

Running on/with	Platform Versions
Netapp Aff A700s	All versions

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (10)

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.19

Source: cve@mitre.org

Mailing ListRelease NotesVendor Advisory

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dbb2483b2a46fbaf833cfb5deb5ed9cace9c7399

Source: cve@mitre.org

Mailing ListPatchVendor Advisory

https://security.netapp.com/advisory/ntap-20210720-0003/

Source: cve@mitre.org

Third Party Advisory

https://sites.google.com/view/syzscope/warning-in-xfrm_state_fini-2

Source: cve@mitre.org

ExploitThird Party Advisory

https://syzkaller.appspot.com/bug?id=f99edaeec58ad40380ed5813d89e205861be2896

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.19