VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2025/38xxx/CVE-2025-38090.json
T

282 lines
15 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-38090",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2025-04-16T04:51:23.982Z",
"datePublished": "2025-06-30T07:29:45.565Z",
"dateUpdated": "2026-08-05T11:59:26.672Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-08-05T11:59:26.672Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/rapidio/rio_cm.c: prevent possible heap overwrite\n\nIn\n\nriocm_cdev_ioctl(RIO_CM_CHAN_SEND)\n -> cm_chan_msg_send()\n -> riocm_ch_send()\n\ncm_chan_msg_send() checks that userspace didn't send too much data but\nriocm_ch_send() failed to check that userspace sent sufficient data. The\nresult is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr\nwhich were outside the bounds of the space which cm_chan_msg_send()\nallocated.\n\nAddress this by teaching riocm_ch_send() to check that the entire\nrio_ch_chan_hdr was copied in from userspace."
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The overflow is triggered through the `RIO_CM_CHAN_SEND` ioctl on the `/dev/rio_cm` character device, requiring local access to the system; no remote peer input is needed to reach the vulnerable write.\nAC:L - The attacker directly chooses `msg.size` (any value 1-19) to control both the slab cache and the overflow offset, the write is unconditional and deterministic with no race involved, and a connected channel is reachable either by the attacker's own connect/accept or by using another process's channel via the unchecked global channel idr.\nPR:L - The rio_cm driver performs no `capable()`/`CAP_*` checks anywhere in its open or ioctl paths, so any unprivileged local user able to open `/dev/rio_cm` can issue the malicious send, and the send path does not even verify that the target channel belongs to the caller's file descriptor.\nUI:N - Exploitation requires only the attacker's own ioctl sequence (create/connect or reuse an existing channel, then send); no action by any other user is needed.\nS:U - The heap corruption occurs in kernel slab memory within the same security authority; there is no crossing of a VM, IOMMU, or other trust boundary.\nC:H - The controlled out-of-bounds write into general-purpose `kmalloc-8`/`kmalloc-16` objects can corrupt adjacent structures (length/size fields, pointers, freelist metadata), which is leverageable into arbitrary kernel memory disclosure.\nI:H - This is a heap out-of-bounds write of up to 17 bytes with attacker-selected target cache and partially attacker-controlled content, a classic primitive for corrupting adjacent kernel objects and escalating to arbitrary write/code execution.\nA:H - Overwriting adjacent slab objects and SLUB freelist data reliably produces kernel oops/panic or list corruption, and the ioctl can be repeated at will to crash the system."
}
]
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/rapidio/rio_cm.c"
],
"versions": [
{
"version": "b6e8d4aa1110306378af0f3472a6b85a1f039a16",
"lessThan": "a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6",
"status": "affected",
"versionType": "git"
},
{
"version": "b6e8d4aa1110306378af0f3472a6b85a1f039a16",
"lessThan": "c03ddc183249f03fc7e057e02cae6f89144d0123",
"status": "affected",
"versionType": "git"
},
{
"version": "b6e8d4aa1110306378af0f3472a6b85a1f039a16",
"lessThan": "58f664614f8c3d6142ab81ae551e466dc6e092e8",
"status": "affected",
"versionType": "git"
},
{
"version": "b6e8d4aa1110306378af0f3472a6b85a1f039a16",
"lessThan": "ecf5ee280b702270afb02f61b299d3dfe3ec7730",
"status": "affected",
"versionType": "git"
},
{
"version": "b6e8d4aa1110306378af0f3472a6b85a1f039a16",
"lessThan": "1921781ec4a8824bd0c520bf9363e28a880d14ec",
"status": "affected",
"versionType": "git"
},
{
"version": "b6e8d4aa1110306378af0f3472a6b85a1f039a16",
"lessThan": "1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53",
"status": "affected",
"versionType": "git"
},
{
"version": "b6e8d4aa1110306378af0f3472a6b85a1f039a16",
"lessThan": "6d5c6711a55c35ce09b90705546050408d9d4b61",
"status": "affected",
"versionType": "git"
},
{
"version": "b6e8d4aa1110306378af0f3472a6b85a1f039a16",
"lessThan": "50695153d7ddde3b1696dbf0085be0033bf3ddb3",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/rapidio/rio_cm.c"
],
"versions": [
{
"version": "4.8",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.8",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.4.295",
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.239",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.186",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.142",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.95",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.12.35",
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.15.4",
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.16",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "5.4.295"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "5.10.239"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "5.15.186"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "6.1.142"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "6.6.95"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "6.12.35"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "6.15.4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8",
"versionEndExcluding": "6.16"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6"
},
{
"url": "https://git.kernel.org/stable/c/c03ddc183249f03fc7e057e02cae6f89144d0123"
},
{
"url": "https://git.kernel.org/stable/c/58f664614f8c3d6142ab81ae551e466dc6e092e8"
},
{
"url": "https://git.kernel.org/stable/c/ecf5ee280b702270afb02f61b299d3dfe3ec7730"
},
{
"url": "https://git.kernel.org/stable/c/1921781ec4a8824bd0c520bf9363e28a880d14ec"
},
{
"url": "https://git.kernel.org/stable/c/1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53"
},
{
"url": "https://git.kernel.org/stable/c/6d5c6711a55c35ce09b90705546050408d9d4b61"
},
{
"url": "https://git.kernel.org/stable/c/50695153d7ddde3b1696dbf0085be0033bf3ddb3"
}
],
"title": "drivers/rapidio/rio_cm.c: prevent possible heap overwrite",
"x_generator": {
"engine": "bippy-1.2.0"
}
},
"adp": [
{
"title": "CVE Program Container",
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2025-11-03T17:33:59.041Z"
}
}
]
}
}
View Git Blame Copy Permalink