| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-38152: remoteproc: core: Clear table_sz when rproc_shutdown |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| remoteproc: core: Clear table_sz when rproc_shutdown |
| |
| There is case as below could trigger kernel dump: |
| Use U-Boot to start remote processor(rproc) with resource table |
| published to a fixed address by rproc. After Kernel boots up, |
| stop the rproc, load a new firmware which doesn't have resource table |
| ,and start rproc. |
| |
| When starting rproc with a firmware not have resource table, |
| `memcpy(loaded_table, rproc->cached_table, rproc->table_sz)` will |
| trigger dump, because rproc->cache_table is set to NULL during the last |
| stop operation, but rproc->table_sz is still valid. |
| |
| This issue is found on i.MX8MP and i.MX9. |
| |
| Dump as below: |
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 |
| Mem abort info: |
| ESR = 0x0000000096000004 |
| EC = 0x25: DABT (current EL), IL = 32 bits |
| SET = 0, FnV = 0 |
| EA = 0, S1PTW = 0 |
| FSC = 0x04: level 0 translation fault |
| Data abort info: |
| ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 |
| CM = 0, WnR = 0, TnD = 0, TagAccess = 0 |
| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 |
| user pgtable: 4k pages, 48-bit VAs, pgdp=000000010af63000 |
| [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 |
| Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP |
| Modules linked in: |
| CPU: 2 UID: 0 PID: 1060 Comm: sh Not tainted 6.14.0-rc7-next-20250317-dirty #38 |
| Hardware name: NXP i.MX8MPlus EVK board (DT) |
| pstate: a0000005 (NzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) |
| pc : __pi_memcpy_generic+0x110/0x22c |
| lr : rproc_start+0x88/0x1e0 |
| Call trace: |
| __pi_memcpy_generic+0x110/0x22c (P) |
| rproc_boot+0x198/0x57c |
| state_store+0x40/0x104 |
| dev_attr_store+0x18/0x2c |
| sysfs_kf_write+0x7c/0x94 |
| kernfs_fop_write_iter+0x120/0x1cc |
| vfs_write+0x240/0x378 |
| ksys_write+0x70/0x108 |
| __arm64_sys_write+0x1c/0x28 |
| invoke_syscall+0x48/0x10c |
| el0_svc_common.constprop.0+0xc0/0xe0 |
| do_el0_svc+0x1c/0x28 |
| el0_svc+0x30/0xcc |
| el0t_64_sync_handler+0x10c/0x138 |
| el0t_64_sync+0x198/0x19c |
| |
| Clear rproc->table_sz to address the issue. |
| |
| The Linux kernel CVE team has assigned CVE-2025-38152 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.13 with commit 9dc9507f1880fb6225e3e058cb5219b152cbf198 and fixed in 5.15.180 with commit 6e66bca8cd51ebedd5d32426906a38e4a3c69c5f |
| Issue introduced in 5.13 with commit 9dc9507f1880fb6225e3e058cb5219b152cbf198 and fixed in 6.1.134 with commit e6015ca453b82ec54aec9682dcc38773948fcc48 |
| Issue introduced in 5.13 with commit 9dc9507f1880fb6225e3e058cb5219b152cbf198 and fixed in 6.6.87 with commit 7c6bb82a6f3da6ab2d3fbea03901482231708b98 |
| Issue introduced in 5.13 with commit 9dc9507f1880fb6225e3e058cb5219b152cbf198 and fixed in 6.12.23 with commit 2df19f5f6f72da6f6ebab7cdb3a3b9f7686bb476 |
| Issue introduced in 5.13 with commit 9dc9507f1880fb6225e3e058cb5219b152cbf198 and fixed in 6.13.11 with commit 8e0fd2a3b9852ac3cf540edb06ccc0153b38b5af |
| Issue introduced in 5.13 with commit 9dc9507f1880fb6225e3e058cb5219b152cbf198 and fixed in 6.14.2 with commit 068f6648ff5b0c7adeb6c363fae7fb188aa178fa |
| Issue introduced in 5.13 with commit 9dc9507f1880fb6225e3e058cb5219b152cbf198 and fixed in 6.15 with commit efdde3d73ab25cef4ff2d06783b0aad8b093c0e4 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-38152 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/remoteproc/remoteproc_core.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/6e66bca8cd51ebedd5d32426906a38e4a3c69c5f |
| https://git.kernel.org/stable/c/e6015ca453b82ec54aec9682dcc38773948fcc48 |
| https://git.kernel.org/stable/c/7c6bb82a6f3da6ab2d3fbea03901482231708b98 |
| https://git.kernel.org/stable/c/2df19f5f6f72da6f6ebab7cdb3a3b9f7686bb476 |
| https://git.kernel.org/stable/c/8e0fd2a3b9852ac3cf540edb06ccc0153b38b5af |
| https://git.kernel.org/stable/c/068f6648ff5b0c7adeb6c363fae7fb188aa178fa |
| https://git.kernel.org/stable/c/efdde3d73ab25cef4ff2d06783b0aad8b093c0e4 |
