| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-37791: ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() |
| |
| rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct |
| size of rpl is sizeof(*rpl) which should be just 1 byte. Using the |
| pointer size instead can cause stack corruption: |
| |
| Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100 |
| CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 |
| Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE |
| Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 |
| Workqueue: events module_flash_fw_work |
| Call Trace: |
| <TASK> |
| panic+0x339/0x360 |
| ? ethtool_cmis_wait_for_cond+0xf4/0x100 |
| ? __pfx_status_success+0x10/0x10 |
| ? __pfx_status_fail+0x10/0x10 |
| __stack_chk_fail+0x10/0x10 |
| ethtool_cmis_wait_for_cond+0xf4/0x100 |
| ethtool_cmis_cdb_execute_cmd+0x1fc/0x330 |
| ? __pfx_status_fail+0x10/0x10 |
| cmis_cdb_module_features_get+0x6d/0xd0 |
| ethtool_cmis_cdb_init+0x8a/0xd0 |
| ethtool_cmis_fw_update+0x46/0x1d0 |
| module_flash_fw_work+0x17/0xa0 |
| process_one_work+0x179/0x390 |
| worker_thread+0x239/0x340 |
| ? __pfx_worker_thread+0x10/0x10 |
| kthread+0xcc/0x100 |
| ? __pfx_kthread+0x10/0x10 |
| ret_from_fork+0x2d/0x50 |
| ? __pfx_kthread+0x10/0x10 |
| ret_from_fork_asm+0x1a/0x30 |
| </TASK> |
| |
| The Linux kernel CVE team has assigned CVE-2025-37791 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.11 with commit a39c84d796254e6b1662ca0c46dbc313379e9291 and fixed in 6.12.25 with commit 61765e1b417a23371c3735e3cddf4ad9354ed2e9 |
| Issue introduced in 6.11 with commit a39c84d796254e6b1662ca0c46dbc313379e9291 and fixed in 6.14.4 with commit 7eb0a0072f966bb0b01d8b7d529d9743a7187bd1 |
| Issue introduced in 6.11 with commit a39c84d796254e6b1662ca0c46dbc313379e9291 and fixed in 6.15 with commit f3fdd4fba16c74697d8bc730b82fb7c1eff7fab3 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-37791 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/ethtool/cmis_cdb.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/61765e1b417a23371c3735e3cddf4ad9354ed2e9 |
| https://git.kernel.org/stable/c/7eb0a0072f966bb0b01d8b7d529d9743a7187bd1 |
| https://git.kernel.org/stable/c/f3fdd4fba16c74697d8bc730b82fb7c1eff7fab3 |
