Heimdall Security Logo

CVE-2025-39684

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, <2.6.29, <=6.12.*, 6.12.44, <=6.16.*, 6.17, 0, ed9eccbe8970f6eedc1b978c157caf1251a896d4, 6.6.103, <3cd212e895ca2d58963fdc6422502b10dd3966bb, 2.6.29, <=6.6.*, 5.15.190, <d84f6e77ebe3359394df32ecd97e0d76a25283dc, 6.1.149, <ff4a7c18799c7fe999fa56c5cf276e13866b8c1a, <f3b0c9ec54736f3b8118f93a473d22e11ee65743, <aecf0d557ddd95ce68193a5ee1dc4c87415ff08a, <=*, <=5.15.*, 6.16.4, <868a1b68dcd9f2805bb86aa64862402f785d8c4a

Description

In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples are copied back to user-space, unless an error code is being returned. The problem is that not all the instruction handlers that need to return data to userspace fill in the whole `insn->n` samples, so that there is an information leak. There is a similar syzbot report for `do_insnlist_ioctl()`, although it does not have a reproducer for it at the time of writing. One culprit is `insn_rw_emulate_bits()` which is used as the handler for `INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have a specific handler for that instruction, but do have an `INSN_BITS` handler. For `INSN_READ` it only fills in at most 1 sample, so if `insn->n` is greater than 1, the remaining `insn->n - 1` samples copied to userspace will be uninitialized kernel data. Another culprit is `vm80xx_ai_insn_read()` in the "vm80xx" driver. It never returns an error, even if it fails to fill the buffer. Fix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure that uninitialized parts of the allocated buffer are zeroed before handling each instruction. Thanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix replaced the call to `kmalloc_array()` with `kcalloc()`, but it is not always necessary to clear the whole buffer.

Gravité et risque d'exploitation

CVE-2025-39684 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.18 %, ce qui la place devant 7.0 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, <2.6.29, <=6.12.*, 6.12.44, <=6.16.*, 6.17, 0, ed9eccbe8970f6eedc1b978c157caf1251a896d4, 6.6.103, <3cd212e895ca2d58963fdc6422502b10dd3966bb, 2.6.29, <=6.6.*, 5.15.190, <d84f6e77ebe3359394df32ecd97e0d76a25283dc, 6.1.149, <ff4a7c18799c7fe999fa56c5cf276e13866b8c1a, <f3b0c9ec54736f3b8118f93a473d22e11ee65743, <aecf0d557ddd95ce68193a5ee1dc4c87415ff08a, <=*, <=5.15.*, 6.16.4, <868a1b68dcd9f2805bb86aa64862402f785d8c4a) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE