200 lines
10 KiB
JSON
200 lines
10 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-39906",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T07:20:57.146Z",
|
|
"datePublished": "2025-10-01T07:44:29.666Z",
|
|
"dateUpdated": "2026-08-05T12:06:00.851Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:06:00.851Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: remove oem i2c adapter on finish\n\nFixes a bug where unbinding of the GPU would leave the oem i2c adapter\nregistered resulting in a null pointer dereference when applications try\nto access the invalid device.\n\n(cherry picked from commit 89923fb7ead4fdd37b78dd49962d9bb5892403e6)"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The freed-but-registered adapter is reached through local interfaces only — `open()`/`ioctl(I2C_RDWR)` on the persisting `/dev/i2c-N` char device and reads of the still-present `/sys/bus/i2c/devices/i2c-N/` attributes. No network or physical access is needed to touch the freed object.\nAC:L - There is no race window: once `dm_hw_fini()` runs, the dangling idr entry, sysfs nodes and `/dev/i2c-N` persist indefinitely, so the attacker triggers the UAF deterministically and repeatedly at a time of their choosing. Driver unbind/module reload is a routine event (driver upgrade, DKMS, VFIO rebind, eGPU unplug) and is directly attacker-initiated where the attacker holds those rights.\nPR:L - Any local unprivileged account can dereference the freed adapter — `/sys/class/i2c-adapter/i2c-N/name` is world-readable 0444 and reads straight out of the freed allocation, and on the desktops that actually expose this OEM bus (board/RGB control) `/dev/i2c-*` is granted to non-root users by the vendor udev rules, giving the full `I2C_RDWR` path.\nUI:N - No victim action is required at exploitation time; the corrupted state is permanent after the driver teardown, so the attacker simply opens the stale device or reads the stale sysfs attribute on their own schedule.\nS:U - The freed object and all consequences (kernel heap corruption, kernel-mode code execution) are within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Reading the still-registered adapter's world-readable sysfs attributes returns bytes from a freed slab object, and reclaiming the allocation lets the attacker read back attacker-chosen or victim-owned kernel heap contents — an arbitrary kernel-memory read primitive, not a bounded leak.\nI:H - The freed `struct i2c_adapter` is still dereferenced for its `algo->master_xfer` and `lock_ops` function-pointer tables on every transfer, and for `get_device()`/`put_device()` refcount and klist operations; spraying the reclaimed slab yields control-flow hijack and list-corruption write primitives, i.e. full kernel compromise.\nA:H - The commit itself documents an oops (\"null pointer dereference when applications try to access the invalid device\"); dereferencing the freed adapter and its dangling `ddc_service`/`dc` chain reliably panics the kernel."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "3d5470c973149f479572dcf4eea064775041ea6c",
|
|
"lessThan": "c686124bcf06253620790857ff462f00f3f7a4ab",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "3d5470c973149f479572dcf4eea064775041ea6c",
|
|
"lessThan": "1dfd2864a1c4909147663e5a27c055f50f7c2796",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.16.8",
|
|
"lessThanOrEqual": "6.16.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.17",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "6.16.8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "6.17"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c686124bcf06253620790857ff462f00f3f7a4ab"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1dfd2864a1c4909147663e5a27c055f50f7c2796"
|
|
}
|
|
],
|
|
"title": "drm/amd/display: remove oem i2c adapter on finish",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"scope": "UNCHANGED",
|
|
"version": "3.1",
|
|
"baseScore": 5.5,
|
|
"attackVector": "LOCAL",
|
|
"baseSeverity": "MEDIUM",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
|
"integrityImpact": "NONE",
|
|
"userInteraction": "NONE",
|
|
"attackComplexity": "LOW",
|
|
"availabilityImpact": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"confidentialityImpact": "NONE"
|
|
}
|
|
},
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2025-39906",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-01-14T19:30:44.445529Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-476",
|
|
"description": "CWE-476 NULL Pointer Dereference"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-01-14T19:33:14.971Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |