linux-cve-announce - CVE-2025-37923: tracing: Fix oob write in trace_seq_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025052003-CVE-2025-37923-1bbf@gregkh>
Date: Tue, 20 May 2025 17:22:20 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-37923: tracing: Fix oob write in trace_seq_to_buffer()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix oob write in trace_seq_to_buffer()

syzbot reported this bug:
==================================================================
BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]
BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822
Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260

CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106
 trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]
 tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822
 ....
==================================================================

It has been reported that trace_seq_to_buffer() tries to copy more data
than PAGE_SIZE to buf. Therefore, to prevent this, we should use the
smaller of trace_seq_used(&iter->seq) and PAGE_SIZE as an argument.

The Linux kernel CVE team has assigned CVE-2025-37923 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.30 with commit 3c56819b14b00dd449bd776303e61f8532fad09f and fixed in 5.15.182 with commit 1a3f9482b50b74fa9421bff8ceecfefd0dc06f8f
	Issue introduced in 2.6.30 with commit 3c56819b14b00dd449bd776303e61f8532fad09f and fixed in 6.1.138 with commit 441021e5b3c7d9bd1b963590652c415929f3b157
	Issue introduced in 2.6.30 with commit 3c56819b14b00dd449bd776303e61f8532fad09f and fixed in 6.6.90 with commit 056ebbddb8faf4ddf83d005454dd78fc25c2d897
	Issue introduced in 2.6.30 with commit 3c56819b14b00dd449bd776303e61f8532fad09f and fixed in 6.12.28 with commit 1f27a3e93b8d674b24b27fcdbc6f72743cd96c0d
	Issue introduced in 2.6.30 with commit 3c56819b14b00dd449bd776303e61f8532fad09f and fixed in 6.14.6 with commit c5d2b66c5ef5037b4b4360e5447605ff00ba1bd4
	Issue introduced in 2.6.30 with commit 3c56819b14b00dd449bd776303e61f8532fad09f and fixed in 6.15-rc5 with commit f5178c41bb43444a6008150fe6094497135d07cb

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-37923
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/trace/trace.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1a3f9482b50b74fa9421bff8ceecfefd0dc06f8f
	https://git.kernel.org/stable/c/441021e5b3c7d9bd1b963590652c415929f3b157
	https://git.kernel.org/stable/c/056ebbddb8faf4ddf83d005454dd78fc25c2d897
	https://git.kernel.org/stable/c/1f27a3e93b8d674b24b27fcdbc6f72743cd96c0d
	https://git.kernel.org/stable/c/c5d2b66c5ef5037b4b4360e5447605ff00ba1bd4
	https://git.kernel.org/stable/c/f5178c41bb43444a6008150fe6094497135d07cb