Skip to content

Commit c39f583

Browse files
author
Rohit Keshri
committed
Analysis for 11 cve's
1 parent 5dddc0d commit c39f583

11 files changed

+146
-0
lines changed

‎vulns/CVE-2025-38352.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: Race
4+
impact: DoS
5+
privileges_required: no
6+
notes:
7+
A race problem was observed between handle_posix_cpu_timers() and posix_cpu_timer_del() in kernel/time/posix-cpu-timers.c
8+
9+
If an exiting non-autoreaping task has already passed exit_notify() and
10+
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
11+
or debugger right after unlock_task_sighand().
12+
13+
If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
14+
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
15+
lock_task_sighand() will fail.
16+
author: RedHat
17+

‎vulns/CVE-2025-38514.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
reachability: Network
2+
memory_corruption: no
3+
bug_class: Oops
4+
impact: DoS
5+
privileges_required: no
6+
notes:
7+
If an AF_RXRPC service socket is opened and bound, but calls are
8+
preallocated, then rxrpc_alloc_incoming_call() will oops because the
9+
rxrpc_backlog struct doesn't get allocated until the first preallocation is
10+
made.
11+
author: RedHat
12+

‎vulns/CVE-2025-38559.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: Null Pointer Dereference
4+
impact: DoS
5+
privileges_required: no
6+
notes:
7+
Usage of the intel_pmt_read() for binary sysfs, requires a pcidev. The
8+
current use of the endpoint value is only valid for telemetry endpoint
9+
usage.
10+
Without the ep, the crashlog usage causes the following NULL pointer
11+
exception:
12+
author: RedHat
13+

‎vulns/CVE-2025-38589.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: Null Pointer Dereference
4+
impact: DoS
5+
privileges_required: no
6+
notes:
7+
A null-ptr-deref in neigh_flush_dev().
8+
author: RedHat
9+

‎vulns/CVE-2025-38606.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: Null Pointer Dereference
4+
impact: DoS
5+
privileges_required: no
6+
notes:
7+
An uninitialized data access (arvif->ar) during beacon miss lead to null pointer
8+
author: RedHat
9+

‎vulns/CVE-2025-39717.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: UAF
4+
impact: DoS
5+
privileges_required: no
6+
notes:
7+
As described in commit 7a54947e727b ('Merge patch series "fs: allow
8+
changing idmappings"'), open_tree_attr(2) was necessary in order to
9+
allow for a detached mount to be created and have its idmappings changed
10+
without the risk of any racing threads operating on it. For this reason,
11+
mount_setattr(2) still does not allow for id-mappings to be changed.
12+
13+
However, there was a bug in commit 2462651ffa76 which allowed users to bypass this restriction by calling
14+
open_tree_attr(2) without OPEN_TREE_CLONE.
15+
16+
can_idmap_mount() prevented this bug from allowing an attached
17+
mountpoint's id-mapping from being modified (thanks to an is_anon_ns()
18+
check), but this still allows for detached (but visible) mounts to have
19+
their be id-mapping changed. This risks the same UAF and locking issues
20+
as described in the merge commit, and was likely unintentional.
21+
author: RedHat
22+

‎vulns/CVE-2025-39727.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
reachability: Local
2+
memory_corruption: yes
3+
bug_class: Buffer Overflow
4+
impact: DoS / Info Leak
5+
privileges_required: no
6+
notes:
7+
In setup_swap_map(), we only ensure badpages are in range (0, last_page].
8+
As maxpages might be < last_page, setup_clusters() will encounter a buffer
9+
overflow when a badpage is >= maxpages.
10+
11+
Only call inc_cluster_info_page() for badpage which is < maxpages to fix
12+
the issue.
13+
author: RedHat
14+

‎vulns/CVE-2025-39742.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: Divide-by-zero
4+
impact: DoS
5+
privileges_required: no
6+
notes:
7+
The function divides number of online CPUs by num_core_siblings, and
8+
later checks the divider by zero. This implies a possibility to get
9+
and divide-by-zero runtime error. Fix it by moving the check prior to
10+
division. This also helps to save one indentation level.
11+
author: RedHat
12+

‎vulns/CVE-2025-39757.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: OOM (Read)
4+
impact: Info Leak
5+
privileges_required: no
6+
notes:
7+
UAC3 class segment descriptors need to be verified whether their sizes
8+
match with the declared lengths and whether they fit with the
9+
allocated buffer sizes, too. Otherwise malicious firmware may lead to
10+
the unexpected OOB accesses.
11+
author: RedHat
12+

‎vulns/CVE-2025-39761.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
reachability: Local
2+
memory_corruption: no
3+
bug_class: OOB (Read)
4+
impact: DoS
5+
privileges_required: no
6+
notes:
7+
Currently, TID is not decremented before peer cleanup, during error
8+
handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to
9+
out-of-bounds access in peer->rx_tid[].
10+
11+
Hence, add a decrement operation for TID, before peer cleanup to
12+
ensures proper cleanup and prevents out-of-bounds access issues when
13+
the RX peer frag setup fails.
14+
author: RedHat
15+

0 commit comments

Comments
 (0)