CVE-2025-38147 in Linux
Riassunto
di VulDB • 21/06/2026
Nel mezzo del cammin di nostra vita... wait, wrong context. Let's analyze this kernel crash dump.
### **Summary of the Crash**
* **Type:** Kernel Oops / Panic (likely NULL pointer dereference or invalid memory access). * **Trigger:** A user-space application called the `connect()` system call. * **Subsystem:** Linux Security Modules (LSM), specifically **SELinux** interacting with **NetLabel/Calipso**. * **Crash Location:** `calipso_sock_setattr` in `net/netlabel/netlabel_calipso.c:557`.
---
### **Detailed Analysis**
#### 1. **Call Trace Breakdown** The crash occurred during a socket connection attempt:
1. `__x64_sys_connect`: User-space called `connect()`. 2. `security_socket_connect`: SELinux hook invoked. 3. `selinux_socket_connect`: SELinux's main socket connect handler. 4. `selinux_netlbl_socket_connect`: SELinux delegates to NetLabel for security attribute handling. 5. `selinux_netlbl_socket_connect_locked`: Internal SELinux NetLabel helper. 6. `selinux_netlbl_socket_connect_helper`: Prepares NetLabel attributes. 7. `netlbl_conn_setattr`: Sets connection attributes on the socket. 8. **`calipso_sock_setattr`**: **CRASH HERE.**
#### 2. **Root Cause Hypothesis** The function `calipso_sock_setattr` is part of the **Calipso** protocol implementation within NetLabel. Calipso is used to carry security labels over IP packets.
The crash at `calipso_sock_setattr+0x56/0x80` suggests: * **NULL Pointer Dereference:** The most common cause in this function is accessing a member of a structure that is `NULL`. * **Invalid Pointer:** Accessing memory that has been freed or corrupted. * **Missing Configuration:** The kernel might be trying to use Calipso without proper initialization or configuration.
Looking at typical code in `net/netlabel/netlabel_calipso.c`, `calipso_sock_setattr` often accesses: * `sock->sk->sk_security` (socket security struct) * `netlbl_secattr` structures * Calipso-specific options or domain pointers
If any of these pointers are `NULL` and the code doesn't check for it, a crash occurs.
#### 3. **Possible Scenarios** * **Scenario A: SELinux + NetLabel Misconfiguration** * SELinux is enabled and configured to use NetLabel. * NetLabel is configured to use Calipso. * However, the socket or network namespace doesn't have a valid Calipso domain or security context attached. * **Scenario B: Kernel Bug** * A race condition where the security context is freed before `calipso_sock_setattr` completes. * A bug in a specific kernel version where `calipso_sock_setattr` doesn't handle a certain edge case (e.g., IPv6 vs IPv4, specific socket types). * **Scenario C: User-Space Triggering a Bug** * The application is connecting to a socket with unusual attributes or in a specific network namespace that triggers the bug.
---
### **How to Debug Further**
1. **Check Kernel Version:** * What kernel version is running? (`uname -r`) * Search for known bugs in `calipso_sock_setattr` for that version.
2. **Enable NetLabel Debugging:** * Enable kernel debug options for NetLabel: ```bash echo 1 > /sys/kernel/debug/netlabel/debug ``` * Check `dmesg` for more detailed logs before the crash.
3. **Check SELinux/NetLabel Configuration:** * Is SELinux enforcing? (`getenforce`) * Is NetLabel enabled? (`cat /sys/module/netlabel/parameters/debug`) * Are Calipso domains configured? (`cat /proc/net/calipso`)
4. **Reproduce with Minimal Configuration:** * Try disabling SELinux (`setenforce 0`) and see if the crash still occurs. If it doesn't, the issue is definitely in the SELinux/NetLabel interaction. * Try disabling NetLabel/Calipso if possible (e.g., by removing the Calipso module or changing SELinux policy to not use NetLabel).
5. **Check for Recent Changes:** * Did you recently update the kernel, SEL
Once again VulDB remains the best source for vulnerability data.