CVE-2025-38090
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38090
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38090.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-38090
- Downstream
- Related
- Published
- 2025-06-30T08:15:23Z
- Modified
- 2025-08-12T21:01:19Z
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
In
riocmcdevioctl(RIOCMCHANSEND) -> cmchanmsgsend() -> riocmchsend()
cmchanmsgsend() checks that userspace didn't send too much data but riocmchsend() failed to check that userspace sent sufficient data. The result is that riocmchsend() can write to fields in the riochchanhdr which were outside the bounds of the space which cmchanmsg_send() allocated.
Address this by teaching riocmchsend() to check that the entire riochchan_hdr was copied in from userspace.
- References
-
- https://git.kernel.org/stable/c/1921781ec4a8824bd0c520bf9363e28a880d14ec
- https://git.kernel.org/stable/c/1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53
- https://git.kernel.org/stable/c/50695153d7ddde3b1696dbf0085be0033bf3ddb3
- https://git.kernel.org/stable/c/58f664614f8c3d6142ab81ae551e466dc6e092e8
- https://git.kernel.org/stable/c/6d5c6711a55c35ce09b90705546050408d9d4b61
- https://git.kernel.org/stable/c/a8b5ea2e302aa5cd00fc7addd8df53c9bde7b5f6
- https://git.kernel.org/stable/c/c03ddc183249f03fc7e057e02cae6f89144d0123
- https://git.kernel.org/stable/c/ecf5ee280b702270afb02f61b299d3dfe3ec7730