Heimdall Security Logo

CVE-2025-38348

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, <=6.12.*, 0, <12134f79e53eb56b0b0b7447fa0c512acf6a8422, <0e4dc150423b829c35cbcf399481ca11594fc036, <da1b9a55ff116cb040528ef664c70a4eec03ae99, 2.6.28, <9701f842031b825e2fd5f22d064166f8f13f6e4d, <=6.15.*, 5.4.295, 5.15.186, <=5.10.*, <=6.6.*, 6.1.142, 7cb770729ba895f73253dfcd46c3fcba45d896f9, 5.10.239, <6d05390d20f110de37d051a3e063ef0a542d01fb, <2.6.28, <=5.4.*, 6.16, <714afb4c38edd19a057d519c1f9c5d164b43de94, 6.12.35, <=*, <f39b2f8c1549a539846e083790fad396ef6cd802, <=5.15.*, 6.15.4, 6.6.95, <1f7f8168abe8cbe845ab8bb557228d44784a6b57

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() Robert Morris reported: |If a malicious USB device pretends to be an Intersil p54 wifi |interface and generates an eeprom_readback message with a large |eeprom->v1.len, p54_rx_eeprom_readback() will copy data from the |message beyond the end of priv->eeprom. | |static void p54_rx_eeprom_readback(struct p54_common *priv, | struct sk_buff *skb) |{ | struct p54_hdr *hdr = (struct p54_hdr *) skb->data; | struct p54_eeprom_lm86 *eeprom = (struct p54_eeprom_lm86 *) hdr->data; | | if (priv->fw_var >= 0x509) { | memcpy(priv->eeprom, eeprom->v2.data, | le16_to_cpu(eeprom->v2.len)); | } else { | memcpy(priv->eeprom, eeprom->v1.data, | le16_to_cpu(eeprom->v1.len)); | } | [...] The eeprom->v{1,2}.len is set by the driver in p54_download_eeprom(). The device is supposed to provide the same length back to the driver. But yes, it's possible (like shown in the report) to alter the value to something that causes a crash/panic due to overrun. This patch addresses the issue by adding the size to the common device context, so p54_rx_eeprom_readback no longer relies on possibly tampered values... That said, it also checks if the "firmware" altered the value and no longer copies them. The one, small saving grace is: Before the driver tries to read the eeprom, it needs to upload >a< firmware. the vendor firmware has a proprietary license and as a reason, it is not present on most distributions by default.

Gravité et risque d'exploitation

CVE-2025-38348 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.20 %, ce qui la place devant 9.4 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, <=6.12.*, 0, <12134f79e53eb56b0b0b7447fa0c512acf6a8422, <0e4dc150423b829c35cbcf399481ca11594fc036, <da1b9a55ff116cb040528ef664c70a4eec03ae99, 2.6.28, <9701f842031b825e2fd5f22d064166f8f13f6e4d, <=6.15.*, 5.4.295, 5.15.186, <=5.10.*, <=6.6.*, 6.1.142, 7cb770729ba895f73253dfcd46c3fcba45d896f9, 5.10.239, <6d05390d20f110de37d051a3e063ef0a542d01fb, <2.6.28, <=5.4.*, 6.16, <714afb4c38edd19a057d519c1f9c5d164b43de94, 6.12.35, <=*, <f39b2f8c1549a539846e083790fad396ef6cd802, <=5.15.*, 6.15.4, 6.6.95, <1f7f8168abe8cbe845ab8bb557228d44784a6b57) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE