linux-cve-announce - CVE-2025-38391: usb: typec: altmodes/displayport: do not index invalid pin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025072508-CVE-2025-38391-0064@gregkh>
Date: Fri, 25 Jul 2025 14:55:22 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38391: usb: typec: altmodes/displayport: do not index invalid pin_assignments

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: altmodes/displayport: do not index invalid pin_assignments

A poorly implemented DisplayPort Alt Mode port partner can indicate
that its pin assignment capabilities are greater than the maximum
value, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show
will cause a BRK exception due to an out of bounds array access.

Prevent for loop in pin_assignment_show from accessing
invalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX
value in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop
condition.

The Linux kernel CVE team has assigned CVE-2025-38391 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.19 with commit 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 and fixed in 5.4.296 with commit c93bc959788ed9a1af7df57cb539837bdf790cee
	Issue introduced in 4.19 with commit 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 and fixed in 5.10.240 with commit 114a977e0f6bf278e05eade055e13fc271f69cf7
	Issue introduced in 4.19 with commit 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 and fixed in 5.15.187 with commit 621d5a3ef0231ab242f2d31eecec40c38ca609c5
	Issue introduced in 4.19 with commit 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 and fixed in 6.1.144 with commit 2f535517b5611b7221ed478527e4b58e29536ddf
	Issue introduced in 4.19 with commit 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 and fixed in 6.6.97 with commit 45e9444b3b97eaf51a5024f1fea92f44f39b50c6
	Issue introduced in 4.19 with commit 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 and fixed in 6.12.37 with commit 5581e694d3a1c2f32c5a51d745c55b107644e1f8
	Issue introduced in 4.19 with commit 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 and fixed in 6.15.6 with commit 47cb5d26f61d80c805d7de4106451153779297a1
	Issue introduced in 4.19 with commit 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 and fixed in 6.16-rc5 with commit af4db5a35a4ef7a68046883bfd12468007db38f1

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38391
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/typec/altmodes/displayport.c
	include/linux/usb/typec_dp.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c93bc959788ed9a1af7df57cb539837bdf790cee
	https://git.kernel.org/stable/c/114a977e0f6bf278e05eade055e13fc271f69cf7
	https://git.kernel.org/stable/c/621d5a3ef0231ab242f2d31eecec40c38ca609c5
	https://git.kernel.org/stable/c/2f535517b5611b7221ed478527e4b58e29536ddf
	https://git.kernel.org/stable/c/45e9444b3b97eaf51a5024f1fea92f44f39b50c6
	https://git.kernel.org/stable/c/5581e694d3a1c2f32c5a51d745c55b107644e1f8
	https://git.kernel.org/stable/c/47cb5d26f61d80c805d7de4106451153779297a1
	https://git.kernel.org/stable/c/af4db5a35a4ef7a68046883bfd12468007db38f1