201 lines
11 KiB
JSON
201 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-38429",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T04:51:24.015Z",
|
|
"datePublished": "2025-07-25T14:16:48.698Z",
|
|
"dateUpdated": "2026-10-30T12:21:58.744Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:21:58.744Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: ep: Update read pointer only after buffer is written\n\nInside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated\nbefore the buffer is written, potentially causing race conditions where\nthe host sees an updated read pointer before the buffer is actually\nwritten. Updating rd_offset prematurely can lead to the host accessing\nan uninitialized or incomplete element, resulting in data corruption.\n\nInvoke the buffer write before updating rd_offset to ensure the element\nis fully written before signaling its availability."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
|
"baseScore": 10,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - MHI EP is the WWAN/modem datapath; event-ring insertions are generated per transfer completion for data crossing the link, including downlink packets originating from remote network peers, so a remote party driving traffic exercises the racy path with no local access to either side.\nAC:L - The window between the MMIO rp publish and the eDMA element write is microseconds wide and the host polls rp continuously, so the race hits under ordinary traffic — the upstream host-side fix describes it as \"the usual pattern\" observed in practice, not a rare interleaving.\nPR:N - No capability check, authentication step, or privilege gate exists anywhere along the path from traffic arrival to mhi_ep_ring_add_element(); event generation is driven purely by host doorbells and channel data movement.\nUI:N - The stale-element exposure occurs during normal automatic MHI event-ring operation; no victim action such as mounting, opening a device, or loading a module is required.\nS:C - The defect is in the endpoint's kernel MHI stack, but the resulting double free and DMA-unmap corruption occur in the host kernel on the other side of the PCIe link — a distinct processor and security authority, analogous to a device/DMA boundary crossing.\nC:H - The host consumes an uninitialized or stale ring element and dereferences attacker-influenced TRE pointers, and the resulting use-after-free over already-completed buffers gives control of freed object contents suitable for arbitrary kernel memory disclosure.\nI:H - Upstream explicitly documents that this ordering bug causes the host to double-free transfer buffers and re-unmap DMA mappings, which is heap corruption exploitable for arbitrary write and control-flow hijack.\nA:H - Double free, DMA unmap of already-unmapped buffers, and pending_pkts refcount underflow reliably oops or panic the host kernel and desynchronize the ring, tearing down the MHI link."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/bus/mhi/ep/ring.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34",
|
|
"lessThan": "e2176aa3ba4361e98d9f91178a762dca6cf21fe0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34",
|
|
"lessThan": "44b9620e82bbec2b9a6ac77f63913636d84f96dc",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34",
|
|
"lessThan": "f704a80d9fa268e51a6cc5242714502c3c1fa605",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34",
|
|
"lessThan": "0007ef098dab48f1ba58364c40b4809f1e21b130",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bbdcba57a1a26a4439a4f4ecdbfaf80a10fd8f34",
|
|
"lessThan": "6f18d174b73d0ceeaa341f46c0986436b3aefc9a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/bus/mhi/ep/ring.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.19",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.19",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.95",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.35",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.15.4",
|
|
"lessThanOrEqual": "6.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.16",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.6.95"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.12.35"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.15.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.19",
|
|
"versionEndExcluding": "6.16"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e2176aa3ba4361e98d9f91178a762dca6cf21fe0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a"
|
|
}
|
|
],
|
|
"title": "bus: mhi: ep: Update read pointer only after buffer is written",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |