Heimdall Security Logo

CVE-2025-38185

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, <=6.12.*, 2.6.12, <1b0ad18704913c92a3ad53748fbc0f219a75b876, 0, <=6.15.*, <2.6.12, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 5.4.295, 5.15.186, <=5.10.*, <=6.6.*, 6.1.142, 5.10.239, <2f370ae1fb6317985f3497b1bb80d457508ca2f7, <c19c0943424b412a84fdf178e6c71fe5480e4f0f, <=5.4.*, 6.16, <e996507f59610e5752b8702537f13f551e7a2c96, <a4b0fd8c25a7583f8564af6cc910418fb8954e89, <ca00f0e6d733ecd9150716d1fd0138d26e674706, 6.12.35, <=*, <=5.15.*, 6.15.4, <3261c017a7c5d2815c6a388c5a3280d1fba0e8db, 6.6.95, <c9260c837de1d2b454960a4a2e44a81272fbcd22

Description

In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Free invalid length skb in atmtcp_c_send(). syzbot reported the splat below. [0] vcc_sendmsg() copies data passed from userspace to skb and passes it to vcc->dev->ops->send(). atmtcp_c_send() accesses skb->data as struct atmtcp_hdr after checking if skb->len is 0, but it's not enough. Also, when skb->len == 0, skb and sk (vcc) were leaked because dev_kfree_skb() is not called and sk_wmem_alloc adjustment is missing to revert atm_account_tx() in vcc_sendmsg(), which is expected to be done in atm_pop_raw(). Let's properly free skb with an invalid length in atmtcp_c_send(). [0]: BUG: KMSAN: uninit-value in atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294 atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294 vcc_sendmsg+0xd7c/0xff0 net/atm/common.c:644 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 __sys_sendmsg net/socket.c:2652 [inline] __do_sys_sendmsg net/socket.c:2657 [inline] __se_sys_sendmsg net/socket.c:2655 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2655 x64_sys_call+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4154 [inline] slab_alloc_node mm/slub.c:4197 [inline] kmem_cache_alloc_node_noprof+0x818/0xf00 mm/slub.c:4249 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:579 __alloc_skb+0x347/0x7d0 net/core/skbuff.c:670 alloc_skb include/linux/skbuff.h:1336 [inline] vcc_sendmsg+0xb40/0xff0 net/atm/common.c:628 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 __sys_sendmsg net/socket.c:2652 [inline] __do_sys_sendmsg net/socket.c:2657 [inline] __se_sys_sendmsg net/socket.c:2655 [inline] __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2655 x64_sys_call+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5798 Comm: syz-executor192 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(undef) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025

Gravité et risque d'exploitation

CVE-2025-38185 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.19 %, ce qui la place devant 8.6 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, <=6.12.*, 2.6.12, <1b0ad18704913c92a3ad53748fbc0f219a75b876, 0, <=6.15.*, <2.6.12, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 5.4.295, 5.15.186, <=5.10.*, <=6.6.*, 6.1.142, 5.10.239, <2f370ae1fb6317985f3497b1bb80d457508ca2f7, <c19c0943424b412a84fdf178e6c71fe5480e4f0f, <=5.4.*, 6.16, <e996507f59610e5752b8702537f13f551e7a2c96, <a4b0fd8c25a7583f8564af6cc910418fb8954e89, <ca00f0e6d733ecd9150716d1fd0138d26e674706, 6.12.35, <=*, <=5.15.*, 6.15.4, <3261c017a7c5d2815c6a388c5a3280d1fba0e8db, 6.6.95, <c9260c837de1d2b454960a4a2e44a81272fbcd22) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE