CVE-2025-21913

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
01/04/2025
Last modified:
03/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()<br /> <br /> Xen doesn&amp;#39;t offer MSR_FAM10H_MMIO_CONF_BASE to all guests. This results<br /> in the following warning:<br /> <br /> unchecked MSR access error: RDMSR from 0xc0010058 at rIP: 0xffffffff8101d19f (xen_do_read_msr+0x7f/0xa0)<br /> Call Trace:<br /> xen_read_msr+0x1e/0x30<br /> amd_get_mmconfig_range+0x2b/0x80<br /> quirk_amd_mmconfig_area+0x28/0x100<br /> pnp_fixup_device+0x39/0x50<br /> __pnp_add_device+0xf/0x150<br /> pnp_add_device+0x3d/0x100<br /> pnpacpi_add_device_handler+0x1f9/0x280<br /> acpi_ns_get_device_callback+0x104/0x1c0<br /> acpi_ns_walk_namespace+0x1d0/0x260<br /> acpi_get_devices+0x8a/0xb0<br /> pnpacpi_init+0x50/0x80<br /> do_one_initcall+0x46/0x2e0<br /> kernel_init_freeable+0x1da/0x2f0<br /> kernel_init+0x16/0x1b0<br /> ret_from_fork+0x30/0x50<br /> ret_from_fork_asm+0x1b/0x30<br /> <br /> based on quirks for a "PNP0c01" device. Treating MMCFG as disabled is the<br /> right course of action, so no change is needed there.<br /> <br /> This was most likely exposed by fixing the Xen MSR accessors to not be<br /> silently-safe.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.1 (including) 6.1.131 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.83 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.12.19 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.13 (including) 6.13.7 (excluding)
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*