| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025102811-CVE-2025-40035-9c37@gregkh> Date: Tue, 28 Oct 2025 12:48:12 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2025-40035: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields. The Linux kernel CVE team has assigned CVE-2025-40035 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.29 with commit 2d56f3a32c0e62f99c043d2579840f9731fe5855 and fixed in 5.15.195 with commit e63aade22a33e77b93c98c9f02db504d897a76b4 Issue introduced in 2.6.29 with commit 2d56f3a32c0e62f99c043d2579840f9731fe5855 and fixed in 6.1.156 with commit 933b87c4590b42500299f00ff55f555903056803 Issue introduced in 2.6.29 with commit 2d56f3a32c0e62f99c043d2579840f9731fe5855 and fixed in 6.6.112 with commit fd8a23ecbc602d00e47b27f20b07350867d0ebe5 Issue introduced in 2.6.29 with commit 2d56f3a32c0e62f99c043d2579840f9731fe5855 and fixed in 6.12.53 with commit 48c96b7e9e03516936d6deba54b5553097eae817 Issue introduced in 2.6.29 with commit 2d56f3a32c0e62f99c043d2579840f9731fe5855 and fixed in 6.17.3 with commit f5e1f3b85aadce74268c46676772c3e9fa79897e Issue introduced in 2.6.29 with commit 2d56f3a32c0e62f99c043d2579840f9731fe5855 and fixed in 6.18-rc1 with commit d3366a04770eea807f2826cbdb96934dd8c9bf79 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-40035 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/input/misc/uinput.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/e63aade22a33e77b93c98c9f02db504d897a76b4 https://git.kernel.org/stable/c/933b87c4590b42500299f00ff55f555903056803 https://git.kernel.org/stable/c/fd8a23ecbc602d00e47b27f20b07350867d0ebe5 https://git.kernel.org/stable/c/48c96b7e9e03516936d6deba54b5553097eae817 https://git.kernel.org/stable/c/f5e1f3b85aadce74268c46676772c3e9fa79897e https://git.kernel.org/stable/c/d3366a04770eea807f2826cbdb96934dd8c9bf79
Powered by blists - more mailing lists