CVE-2025-2073 Overview
CVE-2025-2073 is an out-of-bounds read vulnerability [CWE-125] in the netfilter/ipset subsystem of the Linux kernel as shipped with Google ChromeOS. The flaw affects kernel versions 4.19, 5.4, 5.10, 5.15, and 6.1. A local attacker with low privileges can trigger an out-of-bounds memory read in kernel space, leading to information disclosure of adjacent kernel memory. The exposed data may include pointers, cryptographic material, or other sensitive structures useful for further exploitation chains such as bypassing Kernel Address Space Layout Randomization (KASLR).
Critical Impact
A local low-privileged attacker can read out-of-bounds kernel memory, exposing sensitive data and weakening kernel exploit mitigations.
Affected Products
- Google ChromeOS 16093.103.0
- Linux kernel versions 4.19, 5.4, 5.10, 5.15, 6.1
- Systems using the netfilter/ipset kernel module
Discovery Timeline
- 2025-04-16 - CVE-2025-2073 published to NVD
- 2025-07-11 - Last updated in NVD database
Technical Details for CVE-2025-2073
Vulnerability Analysis
The vulnerability resides in the ipset component of netfilter, the in-kernel framework that powers Linux packet filtering and IP set management. ipset allows administrators and applications to store and match large groups of IP addresses, networks, and ports against firewall rules. The flaw is an out-of-bounds read [CWE-125], meaning kernel code reads memory beyond the bounds of an allocated buffer when processing attacker-controlled input.
Although the listed attack vector is Network, exploitation requires local privileges to interact with ipset interfaces over Netlink. A successful read leaks kernel memory contents to user space, undermining confidentiality of in-kernel data. Disclosed bytes can include pointers, stack canaries, or secret keys that strengthen follow-on privilege escalation attempts.
Root Cause
The root cause is missing or incorrect bounds validation on a buffer access path inside the netfilter/ipset code. When a crafted set definition or lookup request is parsed, the kernel reads past the end of the intended structure. Public technical detail is limited; refer to the Chromium Issue Tracker Entry and the Google Issue Tracker Entry for upstream context.
Attack Vector
An authenticated local user invokes ipset operations through the Netlink interface with malformed parameters. The kernel processes the request and returns out-of-bounds memory contents to user space. No user interaction is required beyond the attacker's own actions. The vulnerability does not require root privileges, only access to functionality that interacts with netfilter/ipset.
No public proof-of-concept exploit is currently available for CVE-2025-2073, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-2073
Indicators of Compromise
- Unexpected user-space processes invoking ipset create, add, or list operations from non-administrative contexts.
- Anomalous Netlink socket activity targeting the NFNL_SUBSYS_IPSET subsystem from unprivileged users.
- Kernel log entries referencing ipset parsing errors or KASAN out-of-bounds read reports on affected hosts.
Detection Strategies
- Audit execve events for invocations of the ipset binary and correlate with the calling user identity and parent process.
- Enable kernel address sanitizer (KASAN) in test environments to surface out-of-bounds reads originating from netfilter/ipset code paths.
- Monitor for repeated failed or malformed Netlink messages to the netfilter subsystem, which can indicate fuzzing or exploitation attempts.
Monitoring Recommendations
- Centralize kernel and auditd logs from ChromeOS and Linux endpoints into a SIEM for retrospective analysis.
- Track ChromeOS device fleet versions and alert on devices running affected kernel builds below the patched ChromeOS release.
- Establish a baseline of legitimate ipset usage and alert on deviations, especially from interactive shell sessions.
How to Mitigate CVE-2025-2073
Immediate Actions Required
- Apply the latest ChromeOS stable channel update to receive the patched kernel build on managed Chromebooks.
- Update Linux distributions running kernels 4.19, 5.4, 5.10, 5.15, or 6.1 to vendor releases that include the upstream netfilter/ipset fix.
- Inventory hosts that load the ip_set module and prioritize patching for any system exposing ipset operations to non-administrative users.
Patch Information
Google has tracked the issue under bug ID 380043638. Patched ChromeOS builds are distributed through the standard ChromeOS auto-update channel. For upstream Linux, consult the kernel stable tree commits referenced in the Chromium Issue Tracker Entry and apply the corresponding distribution updates from Red Hat, Debian, Ubuntu, or SUSE as they become available.
Workarounds
- Restrict access to the ipset utility and the underlying Netlink interface to administrative users only.
- Where ipset is not required, blacklist the ip_set kernel module to remove the vulnerable code path from the running kernel.
- Enforce least privilege on multi-user Linux hosts to limit which accounts can interact with netfilter management interfaces.
# Blacklist the ip_set module if it is not needed
echo 'blacklist ip_set' | sudo tee /etc/modprobe.d/disable-ipset.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep ip_set
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
