| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025060801-CVE-2025-38004-30d2@gregkh> Date: Sun, 8 Jun 2025 12:35:01 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2025-38004: can: bcm: add locking for bcm_op runtime updates From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe' counter is then set to zero. Although this appeared to be a safe operation the updates of 'currframe' can be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh. At the rework of bcm_can_tx() the 'count' variable has been moved into the protected section as this variable can be modified from both contexts too. The Linux kernel CVE team has assigned CVE-2025-38004 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 5.4.294 with commit 8f1c022541bf5a923c8d6fa483112c15250f30a4 Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 5.10.238 with commit 7595de7bc56e0e52b74e56c90f7e247bf626d628 Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 5.15.185 with commit fbd8fdc2b218e979cfe422b139b8f74c12419d1f Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.1.141 with commit 2a437b86ac5a9893c902f30ef66815bf13587bf6 Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.6.93 with commit 76c84c3728178b2d38d5604e399dfe8b0752645e Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.12.31 with commit cc55dd28c20a6611e30596019b3b2f636819a4c0 Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.14.9 with commit c4e8a172501e677ebd8ea9d9161d97dc4df56fbd Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.15 with commit c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-38004 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/can/bcm.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/8f1c022541bf5a923c8d6fa483112c15250f30a4 https://git.kernel.org/stable/c/7595de7bc56e0e52b74e56c90f7e247bf626d628 https://git.kernel.org/stable/c/fbd8fdc2b218e979cfe422b139b8f74c12419d1f https://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6 https://git.kernel.org/stable/c/76c84c3728178b2d38d5604e399dfe8b0752645e https://git.kernel.org/stable/c/cc55dd28c20a6611e30596019b3b2f636819a4c0 https://git.kernel.org/stable/c/c4e8a172501e677ebd8ea9d9161d97dc4df56fbd https://git.kernel.org/stable/c/c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7
Powered by blists - more mailing lists