235 lines
13 KiB
JSON
235 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-38688",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T04:51:24.032Z",
|
|
"datePublished": "2025-09-04T15:32:42.607Z",
|
|
"dateUpdated": "2026-10-15T22:02:28.092Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:03:58.988Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Prevent ALIGN() overflow\n\nWhen allocating IOVA the candidate range gets aligned to the target\nalignment. If the range is close to ULONG_MAX then the ALIGN() can\nwrap resulting in a corrupted iova.\n\nOpen code the ALIGN() using get_add_overflow() to prevent this.\nThis simplifies the checks as we don't need to check for length earlier\neither.\n\nConsolidate the two copies of this code under a single helper.\n\nThis bug would allow userspace to create a mapping that overlaps with some\nother mapping or a reserved range."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"baseScore": 8.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable allocator is reached only through ioctl() on an iommufd character device (/dev/iommu, or /dev/vfio/vfio which shares iommufd_fops), requiring local system access. There is no network-facing path to iopt_alloc_iova().\nAC:L - The overflow is deterministic integer arithmetic on fully attacker-chosen inputs — user_va controls iova_alignment via __ffs64(), length controls roundup_pow_of_two(), and IOMMU_IOAS_MAP_FIXED_IOVA/IOMMU_IOAS_ALLOW_IOVAS let the attacker place a span at the top of the address space. No race, no memory-layout luck; syzbot produced a reproducer.\nPR:L - Any local user holding an iommufd fd can drive IOMMU_IOAS_ALLOC and IOMMU_IOAS_MAP; iommufd_fops_ioctl() dispatches the entire native ioctl table with no capable() gate, and main.c registers /dev/vfio/vfio with mode 0666 using the same fops. No root or real capability is required.\nUI:N - The attacker performs the entire sequence of ioctls itself against its own iommufd context. No victim action or cooperation is needed.\nS:C - The corrupted IOVA lets userspace install a mapping overlapping iopt->reserved_itree entries (IOMMU_RESV_MSI doorbells, IOMMU_RESV_SW_MSI, RMRR/IOMMU_RESV_DIRECT) — precisely the ranges that enforce the IOMMU/DMA protection boundary — and to place mappings outside the VMM-declared allowed IOVA set. Device DMA thereby reaches host resources outside the iommufd context's security authority, a DMA/IOMMU boundary bypass.\nC:H - The bogus IOVA yields a mapping covering memory the caller was never granted, and the resulting divergence between IOMMU page tables and pinned-page accounting can leave device-readable PTEs on freed and reallocated pages, giving an attacker-programmed DMA engine an arbitrary kernel-memory read primitive.\nI:H - The same overlapping mapping is writable, so device DMA can modify memory outside the sanctioned region — including reserved ranges and pages the kernel has freed and handed to other subsystems — and the overlapping area_itree entries corrupt iommufd's own mapping state, yielding an arbitrary write usable for control-flow hijack.\nA:H - Overlapping iommu_map() trips WARN_ON plus -EEXIST in arm_lpae_init_pte(), and the mismatched teardown trips WARN_ON(ret != size) in iommu_unmap_nofail(), producing kernel splats (panic under panic_on_warn); DMA into freed pages and unhandled IOMMU faults crash the system outright."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/iommu/iommufd/io_pagetable.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
|
|
"lessThan": "d19b817540c0abe84854a64ee9ee34cecc3bbeef",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
|
|
"lessThan": "ebb6021560b94649bec6b8faba6fe0dca2218e81",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
|
|
"lessThan": "e42a046bb41dcdde4f766a17d8211842007ed537",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
|
|
"lessThan": "79fad1917802c28de51a479318a056a6fbe3e2f2",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
|
|
"lessThan": "b42497e3c0e74db061eafad41c0cd7243c46436b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/iommu/iommufd/io_pagetable.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.103",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.43",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.15.11",
|
|
"lessThanOrEqual": "6.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.16.2",
|
|
"lessThanOrEqual": "6.16.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.17",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.6.103"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.12.43"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.15.11"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.16.2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.17"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d19b817540c0abe84854a64ee9ee34cecc3bbeef"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ebb6021560b94649bec6b8faba6fe0dca2218e81"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e42a046bb41dcdde4f766a17d8211842007ed537"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/79fad1917802c28de51a479318a056a6fbe3e2f2"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b42497e3c0e74db061eafad41c0cd7243c46436b"
|
|
}
|
|
],
|
|
"title": "iommufd: Prevent ALIGN() overflow",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2025-38688",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:52:48.832507Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T22:02:28.092Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |