lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025050946-CVE-2025-37887-cbe7@gregkh> Date: Fri, 9 May 2025 08:45:54 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result If the FW doesn't support the PDS_CORE_CMD_FW_CONTROL command the driver might at the least print garbage and at the worst crash when the user runs the "devlink dev info" devlink command. This happens because the stack variable fw_list is not 0 initialized which results in fw_list.num_fw_slots being a garbage value from the stack. Then the driver tries to access fw_list.fw_names[i] with i >= ARRAY_SIZE and runs off the end of the array. Fix this by initializing the fw_list and by not failing completely if the devcmd fails because other useful information is printed via devlink dev info even if the devcmd fails. The Linux kernel CVE team has assigned CVE-2025-37887 to this issue. Affected and fixed versions =========================== Issue introduced in 6.4 with commit 45d76f492938cdc27ddadc16e1e75103f4cfbf56 and fixed in 6.6.89 with commit cdd784c96fe2e5edbf0ed9b3e96fe776e8092385 Issue introduced in 6.4 with commit 45d76f492938cdc27ddadc16e1e75103f4cfbf56 and fixed in 6.12.26 with commit 6702f5c6b22deaa95bf84f526148174a160a02cb Issue introduced in 6.4 with commit 45d76f492938cdc27ddadc16e1e75103f4cfbf56 and fixed in 6.14.5 with commit 12a4651a80dbe4589a84e26785fbbe1ed4d043b7 Issue introduced in 6.4 with commit 45d76f492938cdc27ddadc16e1e75103f4cfbf56 and fixed in 6.15-rc4 with commit 2567daad69cd1107fc0ec29b1615f110d7cf7385 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-37887 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/amd/pds_core/devlink.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/cdd784c96fe2e5edbf0ed9b3e96fe776e8092385 https://git.kernel.org/stable/c/6702f5c6b22deaa95bf84f526148174a160a02cb https://git.kernel.org/stable/c/12a4651a80dbe4589a84e26785fbbe1ed4d043b7 https://git.kernel.org/stable/c/2567daad69cd1107fc0ec29b1615f110d7cf7385
Powered by blists - more mailing lists