linux-kernel - Re: CVE-2025-39898: e1000e: fix heap overflow in e1000_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0ec765e1-1bbd-4a7d-baf6-0163b64fd9a3@intel.com>
Date: Tue, 28 Oct 2025 11:14:30 -0700
From: Tony Nguyen <anthony.l.nguyen@...el.com>
To: Andrew Lunn <andrew@...n.ch>, Steffen Jaeckel <sjaeckel@...e.de>
CC: <cve@...nel.org>, <linux-kernel@...r.kernel.org>,
	<linux-cve-announce@...r.kernel.org>, Greg Kroah-Hartman <gregkh@...nel.org>,
	Vitaly Lifshits <vitaly.lifshits@...el.com>, <dima.ruinskiy@...el.com>,
	Mikael Wessel <post@...aelkw.online>, Mor Bar-Gabay
	<morx.bar.gabay@...el.com>, <davem@...emloft.net>, <kuba@...nel.org>,
	<pabeni@...hat.com>, <edumazet@...gle.com>, <andrew+netdev@...n.ch>
Subject: Re: CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom



On 10/27/2025 2:46 PM, Andrew Lunn wrote:
>> we believe that this CVE is invalid since the sole caller is
>> `net/ethtool/ioctl.c:ethtool_set_eeprom()`, which already does all the
>> necessary checks before invoking a driver specific implementation.
> 
> It is either invalid, or the fix is only fixing e1000, and very
> likely, the same issue exists in lots of other drivers, so the fix is
> wrong and should be done somewhere else...
> 
> This fix adds to the e1000e driver:
> 
> +       if (check_add_overflow(eeprom->offset, eeprom->len, &total_len) ||
> +           total_len > max_len)
> +               return -EFBIG;
> 
> In the core, ethtool_set_eeprom() we have:
> 
>         /* Check for wrap and zero */
>          if (eeprom.offset + eeprom.len <= eeprom.offset)
>                  return -EINVAL;
> 
>          /* Check for exceeding total eeprom len */
>          if (eeprom.offset + eeprom.len > ops->get_eeprom_len(dev))
>                  return -EINVAL;
> 
> Are they equivalent? Is the core broken?

The checks in ethtool_set_eeprom() look to be equivalent to what we were 
adding to e1000e so I think core checks are sufficient, and the e1000e 
ones, unneeded.

Thanks,
Tony

> 
> I will leave it to somebody who understands wraparound to decide.
> 
> 	Andrew