| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025081657-CVE-2025-38538-2147@gregkh> Date: Sat, 16 Aug 2025 13:14:09 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2025-38538: dmaengine: nbpfaxi: Fix memory corruption in probe() From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: dmaengine: nbpfaxi: Fix memory corruption in probe() The nbpf->chan[] array is allocated earlier in the nbpf_probe() function and it has "num_channels" elements. These three loops iterate one element farther than they should and corrupt memory. The changes to the second loop are more involved. In this case, we're copying data from the irqbuf[] array into the nbpf->chan[] array. If the data in irqbuf[i] is the error IRQ then we skip it, so the iterators are not in sync. I added a check to ensure that we don't go beyond the end of the irqbuf[] array. I'm pretty sure this can't happen, but it seemed harmless to add a check. On the other hand, after the loop has ended there is a check to ensure that the "chan" iterator is where we expect it to be. In the original code we went one element beyond the end of the array so the iterator wasn't in the correct place and it would always return -EINVAL. However, now it will always be in the correct place. I deleted the check since we know the result. The Linux kernel CVE team has assigned CVE-2025-38538 to this issue. Affected and fixed versions =========================== Issue introduced in 3.17 with commit b45b262cefd5b8eb2ba88d20e5bd295881293894 and fixed in 6.1.147 with commit f366b36c5e3ce29c9a3c8eed3d1631908e4fc8bb Issue introduced in 3.17 with commit b45b262cefd5b8eb2ba88d20e5bd295881293894 and fixed in 6.6.100 with commit 4bb016438335ec02b01f96bf1367378c2bfe03e5 Issue introduced in 3.17 with commit b45b262cefd5b8eb2ba88d20e5bd295881293894 and fixed in 6.12.40 with commit 122160289adf8ebf15060f1cbf6265b55a914948 Issue introduced in 3.17 with commit b45b262cefd5b8eb2ba88d20e5bd295881293894 and fixed in 6.15.8 with commit d6bbd67ab5de37a74ac85c83c5a26664b62034dd Issue introduced in 3.17 with commit b45b262cefd5b8eb2ba88d20e5bd295881293894 and fixed in 6.16 with commit 188c6ba1dd925849c5d94885c8bbdeb0b3dcf510 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-38538 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/dma/nbpfaxi.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f366b36c5e3ce29c9a3c8eed3d1631908e4fc8bb https://git.kernel.org/stable/c/4bb016438335ec02b01f96bf1367378c2bfe03e5 https://git.kernel.org/stable/c/122160289adf8ebf15060f1cbf6265b55a914948 https://git.kernel.org/stable/c/d6bbd67ab5de37a74ac85c83c5a26664b62034dd https://git.kernel.org/stable/c/188c6ba1dd925849c5d94885c8bbdeb0b3dcf510
Powered by blists - more mailing lists