CVE-2025-43915: Linkerd resource exhaustion vulnerability
6.5
Basic Information
GoTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/linkerd/linkerd2 | go | < 0.6.0-20250501173313-4823b7af3e1e | 0.6.0-20250501173313-4823b7af3e1e |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability is related to resource exhaustion in Linkerd proxy metrics. The fix involves updating the tokio-metrics dependency from version 0.4.1 to 0.4.2.
The commits in tokio-metrics between these versions primarily involve documentation changes, build process improvements (adding semver checks, badges), and minor fixes related to feature flags and documentation generation.
There are no specific code changes in the tokio-metrics diff that directly point to a resource exhaustion vulnerability or its fix. The vulnerability likely lies in how Linkerd uses tokio-metrics or in a subtle interaction that is resolved by the version bump, rather than a specific vulnerable function within tokio-metrics itself that was patched.
Without more specific information linking the resource exhaustion to particular functions in tokio-metrics or Linkerd's usage of it, it's not possible to identify vulnerable functions with high confidence based solely on the provided commit information. The fix is a dependency update, suggesting the vulnerability was in the older version of tokio-metrics or its interaction with Linkerd, but the specific vulnerable functions are not evident from the patch diffs of tokio-metrics itself, as these are mostly documentation and CI changes. The actual fix for the resource exhaustion is not explicitly shown in these commits beyond the version bump of the dependency.
Therefore, I cannot confidently identify specific vulnerable functions based on the provided information. The core issue seems to be in the older tokio-metrics version or its integration, and the fix is simply to use a newer version. The commits for tokio-metrics v0.4.2 don't reveal the exact nature of the resource exhaustion fix itself within that library's code changes for that specific version jump, as they are mostly documentation and CI updates. The actual vulnerability might have been fixed in an earlier micro-patch or a different component, and 0.4.2 is just the version Linkerd updated to, which includes that fix among others, or the fix is not obvious from the commit messages and code changes in tokio-metrics itself between 0.4.1 and 0.4.2 as presented in the diffs (which are mostly docs/CI).