| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025090550-CVE-2025-39713-ec93@gregkh> Date: Fri, 5 Sep 2025 19:21:26 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2025-39713: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team. The Linux kernel CVE team has assigned CVE-2025-39713 to this issue. Affected and fixed versions =========================== Issue introduced in 4.12 with commit 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac and fixed in 5.4.297 with commit 2964dbe631fd21ad7873b1752b895548d3c12496 Issue introduced in 4.12 with commit 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac and fixed in 5.10.241 with commit 6aaef1a75985865d8c6c5b65fb54152060faba48 Issue introduced in 4.12 with commit 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac and fixed in 5.15.190 with commit fbc81e78d75bf28972bc22b1599559557b1a1b83 Issue introduced in 4.12 with commit 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac and fixed in 6.1.149 with commit 3c3e33b7edca7a2d6a96801f287f9faeb684d655 Issue introduced in 4.12 with commit 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac and fixed in 6.6.103 with commit 1c2769dc80255824542ea5a4ff1a07dcdeb1603f Issue introduced in 4.12 with commit 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac and fixed in 6.12.44 with commit ed905fe7cba03cf22ae0b84cf1b73cd1c070423a Issue introduced in 4.12 with commit 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac and fixed in 6.16.4 with commit ff9dd3db6cd4c6b54a2ecbc58151bea4ec63bc59 Issue introduced in 4.12 with commit 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac and fixed in 6.17-rc1 with commit 7af160aea26c7dc9e6734d19306128cce156ec40 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-39713 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/media/cec/usb/rainshadow/rainshadow-cec.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/2964dbe631fd21ad7873b1752b895548d3c12496 https://git.kernel.org/stable/c/6aaef1a75985865d8c6c5b65fb54152060faba48 https://git.kernel.org/stable/c/fbc81e78d75bf28972bc22b1599559557b1a1b83 https://git.kernel.org/stable/c/3c3e33b7edca7a2d6a96801f287f9faeb684d655 https://git.kernel.org/stable/c/1c2769dc80255824542ea5a4ff1a07dcdeb1603f https://git.kernel.org/stable/c/ed905fe7cba03cf22ae0b84cf1b73cd1c070423a https://git.kernel.org/stable/c/ff9dd3db6cd4c6b54a2ecbc58151bea4ec63bc59 https://git.kernel.org/stable/c/7af160aea26c7dc9e6734d19306128cce156ec40
Powered by blists - more mailing lists