SB20250402102 - Use of uninitialized resource in Linux kernel net ppp driver
Published: April 2, 2025 Updated: May 11, 2025
Security Bulletin ID
SB20250402102
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use of uninitialized resource (CVE-ID: CVE-2025-21922)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to use of uninitialized resource within the ppp_send_frame() and ppp_receive_nonmp_frame() functions in drivers/net/ppp/ppp_generic.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/1eacd47636a9de5bee25d9d5962dc538a82d9f0b
- https://git.kernel.org/stable/c/2f591cb158807bdcf424f66f1fbfa6e4e50f3757
- https://git.kernel.org/stable/c/3de809a768464528762757e433cd50de35bcb3c1
- https://git.kernel.org/stable/c/4c2d14c40a68678d885eab4008a0129646805bae
- https://git.kernel.org/stable/c/4e2191b0fd0c064d37b0db67396216f2d4787e0f
- https://git.kernel.org/stable/c/8aa8a40c766b3945b40565a70349d5581458ff63
- https://git.kernel.org/stable/c/c036f5f2680cbdabdbbace86baee3c83721634d6
- https://git.kernel.org/stable/c/d685096c8129c9a92689975193e268945fd21dbf
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.291