Към съдържанието
Търсене

CVE-2025-68795: Linux, грешка в паметта

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on stats query The ethtool -S command operates across three ioctl calls: ETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and ETHTOOL_GSTATS for the values. If the number of stats changes between these calls (e.g., due to device reconfiguration), userspace's buffer allocation will be incorrect, potentially leading to buffer overflow. Drivers are generally expected to maintain stable stat counts, but some drivers (e.g., mlx5, bnx2x, bna, ksz884x) use dynamic counters, making this scenario possible. Some drivers try to handle this internally: - bnad_get_ethtool_stats() returns early in case stats.n_stats is not equal to the driver's stats count. - micrel/ksz884x also makes sure not to write anything beyond stats.n_stats and overflow the buffer. However, both use stats.n_stats which is already assigned with the value returned from get_sset_count(), hence won't solve the issue described here. Change ethtool_get_strings(), ethtool_get_stats(), ethtool_get_phy_stats() to not return anything in case of a mismatch between userspace's size and get_sset_size(), to prevent buffer overflow. The returned n_stats value will be equal to zero, to reflect that nothing has been returned. This could result in one of two cases when using upstream ethtool, depending on when the size change is detected: 1. When detected in ethtool_get_strings(): # ethtool -S eth2 no stats available 2. When detected in get stats, all stats will be reported as zero. Both cases are presumably transient, and a subsequent ethtool call should succeed. Other than the overflow avoidance, these two cases are very evident (no output/cleared stats), which is arguably better than presenting incorrect/shifted stats. I also considered returning an error instead of a "silent" response, but that seems more destructive towards userspace apps. Notes: - This patch does not

Засегнати продукти

  • Linux Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 3df375a1e75483b7d973c3cc2e46aa374db8428b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди f9dc0f45d2cd0189ce666288a29d2cc32c2e44d5; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 4afcb985355210e1688560dc47e64b94dad35d71; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди ca9983bc3a1189bd72f9ae449d925a66b2616326; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 7bea09f60f2ad5d232e2db8f1c14e850fd3fd416; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 4066b5b546293f44cd6d0e84ece6e3ee7ff27093; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 7b07be1ff1cb6c49869910518650e8d0abc7d25f
  • Linux Linux: 2.6.12; преди 2.6.12; 5.10.248 до 5.10.*; 5.15.198 до 5.15.*; 6.1.160 до 6.1.*; 6.6.120 до 6.6.*; 6.12.64 до 6.12.*; 6.18.3 до 6.18.*; 6.19 до *

Вид слабост

История

  • 13 януари 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2025-68795: Linux, грешка в паметта | freedomonline.bg