linux-cve-announce - CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025050946-CVE-2025-37887-cbe7@gregkh>
Date: Fri,  9 May 2025 08:45:54 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result

If the FW doesn't support the PDS_CORE_CMD_FW_CONTROL command
the driver might at the least print garbage and at the worst
crash when the user runs the "devlink dev info" devlink command.

This happens because the stack variable fw_list is not 0
initialized which results in fw_list.num_fw_slots being a
garbage value from the stack.  Then the driver tries to access
fw_list.fw_names[i] with i >= ARRAY_SIZE and runs off the end
of the array.

Fix this by initializing the fw_list and by not failing
completely if the devcmd fails because other useful information
is printed via devlink dev info even if the devcmd fails.

The Linux kernel CVE team has assigned CVE-2025-37887 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit 45d76f492938cdc27ddadc16e1e75103f4cfbf56 and fixed in 6.6.89 with commit cdd784c96fe2e5edbf0ed9b3e96fe776e8092385
	Issue introduced in 6.4 with commit 45d76f492938cdc27ddadc16e1e75103f4cfbf56 and fixed in 6.12.26 with commit 6702f5c6b22deaa95bf84f526148174a160a02cb
	Issue introduced in 6.4 with commit 45d76f492938cdc27ddadc16e1e75103f4cfbf56 and fixed in 6.14.5 with commit 12a4651a80dbe4589a84e26785fbbe1ed4d043b7
	Issue introduced in 6.4 with commit 45d76f492938cdc27ddadc16e1e75103f4cfbf56 and fixed in 6.15-rc4 with commit 2567daad69cd1107fc0ec29b1615f110d7cf7385

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-37887
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/amd/pds_core/devlink.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/cdd784c96fe2e5edbf0ed9b3e96fe776e8092385
	https://git.kernel.org/stable/c/6702f5c6b22deaa95bf84f526148174a160a02cb
	https://git.kernel.org/stable/c/12a4651a80dbe4589a84e26785fbbe1ed4d043b7
	https://git.kernel.org/stable/c/2567daad69cd1107fc0ec29b1615f110d7cf7385