138 lines
7.8 KiB
JSON
138 lines
7.8 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-39680",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T07:20:57.112Z",
|
|
"datePublished": "2025-09-05T17:20:46.456Z",
|
|
"dateUpdated": "2026-08-05T12:04:30.326Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:04:30.326Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer\n\nThe data->block[0] variable comes from user. Without proper check,\nthe variable may be very large to cause an out-of-bounds bug.\n\nFix this bug by checking the value of data->block[0] first.\n\n1. commit 39244cc75482 (\"i2c: ismt: Fix an out-of-bounds bug in\n ismt_access()\")\n2. commit 92fbb6d1296f (\"i2c: xgene-slimpro: Fix out-of-bounds bug in\n xgene_slimpro_i2c_xfer()\")"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable code is reached only through the `I2C_SMBUS` ioctl on a local `/dev/i2c-N` character device (`i2cdev_ioctl_smbus` → `i2c_smbus_xfer` → `rtl9300_i2c_smbus_xfer`). There is no network or remote-peer path into this driver.\nAC:L - A single ioctl with an attacker-chosen `data->block[0]` deterministically drives the unvalidated length into `rtl9300_i2c_config_xfer()` and the transfer helpers; there is no race, timing window, or memory-layout condition outside the attacker's control.\nPR:L - `i2cdev_open()` and `i2cdev_ioctl()` contain no `capable()`/`CAP_*` check whatsoever — reachability depends purely on `/dev/i2c-*` node permissions, which embedded, switch, and Android-style images commonly grant to a non-root `i2c` group. Matches the PR:L used for the analogous CVE-2026-64191 and CVE-2026-31627.\nUI:N - The attacker triggers the flaw entirely on their own with one ioctl on an already-present device node; no victim action, mount, or file-open is needed.\nS:U - The unvalidated length is consumed within the kernel's own memory and the SoC's I²C controller registers, all under the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked user-supplied length propagates to out-of-bounds reads past the 34-byte `union i2c_smbus_data` on the caller's stack (via `trace_smbus_write()` on the shared path, and via `i2c_smbus_read_block_data()`'s `memcpy` of the driver-overwritten `block[0]`), exposing adjacent kernel stack contents.\nI:H - The same value reaches an out-of-bounds write context — `i2c_smbus_read_block_data()` copies a length of up to 255 into a 32-byte caller buffer — and the `(len - 1) & 0xf` underflow programs unintended hardware writes, which the same-driver CVE-2025-39928 documents as destructive (overwriting SFP EEPROM contents).\nA:H - Out-of-bounds stack access of this kind produces oopses/panics under KASAN or on corrupted stack state, and the spurious 16-byte hardware transfer can permanently brick attached I²C peripherals, denying service to the device."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/i2c/busses/i2c-rtl9300.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "c366be720235301fdadf67e6f1ea6ff32669c074",
|
|
"lessThan": "071e43fcba5ddd9a7813e6cc0aa10299eae41b21",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c366be720235301fdadf67e6f1ea6ff32669c074",
|
|
"lessThan": "57f312b955938fc4663f430cb57a71f2414f601b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/i2c/busses/i2c-rtl9300.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.13",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.13",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.16.4",
|
|
"lessThanOrEqual": "6.16.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.17",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.13",
|
|
"versionEndExcluding": "6.16.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.13",
|
|
"versionEndExcluding": "6.17"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/071e43fcba5ddd9a7813e6cc0aa10299eae41b21"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/57f312b955938fc4663f430cb57a71f2414f601b"
|
|
}
|
|
],
|
|
"title": "i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |