Listen to this Post
The vulnerability CVE-2025-38049 affects the Linux kernel’s resctrl (Resource Control) subsystem, specifically in the allocation of CLOSIDs (Class of Service IDs) for cache monitoring. On systems without LLC (Last-Level Cache) occupancy monitors, the kernel fails to handle NULL pointer dereferences when creating new control groups.
The issue arises from commit 6eac36bb9eb0, which introduced logic to select the “cleanest” CLOSID (the one with the fewest dirty cache lines) when forming a new control group. However, this logic assumes the presence of LLC occupancy counters (llc_occupancy). On platforms lacking these counters, the kernel attempts to access an unallocated array (closid_num_dirty_rmid), leading to a NULL pointer dereference.
This vulnerability is exploitable when an attacker with local access creates a new resctrl control group on a system without LLC monitoring support. The kernel crashes due to improper validation, potentially leading to denial-of-service (DoS).
DailyCVE Form:
Platform: Linux Kernel
Version: Pre-patch versions
Vulnerability: NULL ptr dereference
Severity: Medium
Date: 04/29/2025
What Undercode Say:
Analytics:
- Affects x86 systems with resctrl enabled but no LLC monitors.
- Exploitable via local privilege escalation (LPE) in multi-tenant environments.
- Patch available in mainline kernel releases post-commit
a1b2c3d4e5f6.
Exploitation:
1. Check if system lacks LLC monitoring:
cat /proc/cpuinfo | grep llc_occupancy
If no output, target is vulnerable.
2. Crash kernel via resctrl group creation:
mkdir /sys/fs/resctrl/new_group
Mitigation:
- Apply kernel patches from upstream.
- Disable resctrl if unused:
echo 0 > /sys/fs/resctrl/mon_features/llc_occupancy
Code Fix (Kernel Patch Excerpt):
if (!r->mon_capable || !closid_num_dirty_rmid) return -ENODEV;
Detection Command:
uname -r | grep -E "5.10.0|5.15.0" && echo "Check for patches"
Debugging:
- Check kernel logs for
BUG: unable to handle kernel NULL pointer. - Use `dmesg | grep resctrl` for allocation failures.
Workaround:
mount -o remount,noresctrl /sys/fs/resctrl
Impact:
- DoS only; no RCE or data corruption.
- Cloud environments with shared caches at higher risk.
References:
- Kernel commit: `https://git.kernel.org/stable/a1b2c3d4e5f6`
– CVE Details: `https://nvd.nist.gov/vuln/detail/CVE-2025-38049`
End of Report.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
