linux-cve-announce - CVE-2025-38068: crypto: lzo - Fix compression buffer overrun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061837-CVE-2025-38068-02a8@gregkh>
Date: Wed, 18 Jun 2025 11:34:03 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38068: crypto: lzo - Fix compression buffer overrun

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

crypto: lzo - Fix compression buffer overrun

Unlike the decompression code, the compression code in LZO never
checked for output overruns.  It instead assumes that the caller
always provides enough buffer space, disregarding the buffer length
provided by the caller.

Add a safe compression interface that checks for the end of buffer
before each write.  Use the safe interface in crypto/lzo.

The Linux kernel CVE team has assigned CVE-2025-38068 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.15.185 with commit 4b173bb2c4665c23f8fcf5241c7b06dfa6b5b111
	Fixed in 6.1.141 with commit a98bd864e16f91c70b2469adf013d713d04d1d13
	Fixed in 6.6.93 with commit 0acdc4d6e679ba31d01e3e7e2e4124b76d6d8e2a
	Fixed in 6.12.31 with commit 7caad075acb634a74911830d6386c50ea12566cd
	Fixed in 6.14.9 with commit 167373d77c70c2b558aae3e327b115249bb2652c
	Fixed in 6.15 with commit cc47f07234f72cbd8e2c973cdbf2a6730660a463

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38068
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	crypto/lzo-rle.c
	crypto/lzo.c
	include/linux/lzo.h
	lib/lzo/Makefile
	lib/lzo/lzo1x_compress.c
	lib/lzo/lzo1x_compress_safe.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4b173bb2c4665c23f8fcf5241c7b06dfa6b5b111
	https://git.kernel.org/stable/c/a98bd864e16f91c70b2469adf013d713d04d1d13
	https://git.kernel.org/stable/c/0acdc4d6e679ba31d01e3e7e2e4124b76d6d8e2a
	https://git.kernel.org/stable/c/7caad075acb634a74911830d6386c50ea12566cd
	https://git.kernel.org/stable/c/167373d77c70c2b558aae3e327b115249bb2652c
	https://git.kernel.org/stable/c/cc47f07234f72cbd8e2c973cdbf2a6730660a463