linux-cve-announce - CVE-2025-37784: net: ti: icss-iep: Fix possible NULL pointer dereference for perout request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025050118-CVE-2025-37784-159b@gregkh>
Date: Thu,  1 May 2025 15:07:32 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-37784: net: ti: icss-iep: Fix possible NULL pointer dereference for perout request

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: ti: icss-iep: Fix possible NULL pointer dereference for perout request

The ICSS IEP driver tracks perout and pps enable state with flags.
Currently when disabling pps and perout signals during icss_iep_exit(),
results in NULL pointer dereference for perout.

To fix the null pointer dereference issue, the icss_iep_perout_enable_hw
function can be modified to directly clear the IEP CMP registers when
disabling PPS or PEROUT, without referencing the ptp_perout_request
structure, as its contents are irrelevant in this case.

The Linux kernel CVE team has assigned CVE-2025-37784 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.70 with commit d6b130fabfe197935346fe9f1e50a0947b2b1be7 and fixed in 6.6.88 with commit 7891619d21f07a88e0275d6d43db74035aa74f69
	Issue introduced in 6.12.9 with commit 4ac8e8bf70b436294534d06e5d500e950e20c13d and fixed in 6.12.25 with commit da5035d7aeadcfa44096dd34689bfed6c657f559
	Issue introduced in 6.13 with commit 9b115361248dc6cce182a2dc030c1c70b0a9639e and fixed in 6.14.4 with commit eeec66327001421531b3fb1a2ac32efc8a2493b0
	Issue introduced in 6.13 with commit 9b115361248dc6cce182a2dc030c1c70b0a9639e and fixed in 6.15-rc3 with commit 7349c9e9979333abfce42da5f9025598083b59c9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-37784
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/ti/icssg/icss_iep.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7891619d21f07a88e0275d6d43db74035aa74f69
	https://git.kernel.org/stable/c/da5035d7aeadcfa44096dd34689bfed6c657f559
	https://git.kernel.org/stable/c/eeec66327001421531b3fb1a2ac32efc8a2493b0
	https://git.kernel.org/stable/c/7349c9e9979333abfce42da5f9025598083b59c9