Time-of-check Time-of-use (TOCTOU) Affecting kernel-modules-extra-common package, versions <0:6.12.29-33.102.amzn2023


Severity

Recommended
high

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.06% (20th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2023-KERNELMODULESEXTRACOMMON-10496992
  • published24 Jun 2025
  • disclosed20 May 2025

Introduced: 20 May 2025

CVE-2025-37915  (opens in a new tab)
CWE-367  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 kernel-modules-extra-common to version 0:6.12.29-33.102.amzn2023 or higher.
This issue was patched in ALAS2023-2025-994.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-modules-extra-common package and not the kernel-modules-extra-common package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

net_sched: drr: Fix double list add in class with netem as child qdisc

As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption.

In addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_is_active) before adding to the list to cover for the reentrant case.

[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

CVSS Base Scores

version 3.1