CVE-2025-38348
published 2025-07-10CVE-2025-38348: In the Linux kernel, the following vulnerability has been resolved: wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() Robert Morris reported: |If…
high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
In the Linux kernel, the following vulnerability has been resolved:
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
Robert Morris reported:
|If a malicious USB device pretends to be an Intersil p54 wifi
|interface and generates an eeprom_readback message with a large
|eeprom->v1.len, p54_rx_eeprom_readback() will copy data from the
|message beyond the end of priv->eeprom.
|
|static void p54_rx_eeprom_readback(struct p54_common *priv,
| struct sk_buff *skb)
|{
| struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
| struct p54_eeprom_lm86 *eeprom = (struct p54_eeprom_lm86 *) hdr->data;
|
| if (priv->fw_var >= 0x509) {
| memcpy(priv->eeprom, eeprom->v2.data,
| le16_to_cpu(eeprom->v2.len));
| } else {
| memcpy(priv->eeprom, eeprom->v1.data,
| le16_to_cpu(eeprom->v1.len));
| }
| [...]
The eeprom->v{1,2}.len is set by the driver in p54_download_eeprom().
The device is supposed to provide the same length back to the driver.
But yes, it's possible (like shown in the report) to alter the value
to something that causes a crash/panic due to overrun.
This patch addresses the issue by adding the size to the common device
context, so p54_rx_eeprom_readback no longer relies on possibly tampered
values... That said, it also checks if the "firmware" altered the value
and no longer copies them.
The one, small saving grace is: Before the driver tries to read the eeprom,
it needs to upload >a< firmware. the vendor firmware has a proprietary
license and as a reason, it is not present on most distributions by
default.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 7cb770729ba895f73253dfcd46c3fcba45d896f9 < 12134f79e53eb56b0b0b7447fa0c512acf6a8422 | 12134f79e53eb56b0b0b7447fa0c512acf6a8422 |
| linux | linux | >= 7cb770729ba895f73253dfcd46c3fcba45d896f9 < 9701f842031b825e2fd5f22d064166f8f13f6e4d | 9701f842031b825e2fd5f22d064166f8f13f6e4d |
| linux | linux | >= 7cb770729ba895f73253dfcd46c3fcba45d896f9 < 1f7f8168abe8cbe845ab8bb557228d44784a6b57 | 1f7f8168abe8cbe845ab8bb557228d44784a6b57 |
| linux | linux | >= 7cb770729ba895f73253dfcd46c3fcba45d896f9 < f39b2f8c1549a539846e083790fad396ef6cd802 | f39b2f8c1549a539846e083790fad396ef6cd802 |
| linux | linux | >= 7cb770729ba895f73253dfcd46c3fcba45d896f9 < 0e4dc150423b829c35cbcf399481ca11594fc036 | 0e4dc150423b829c35cbcf399481ca11594fc036 |
| linux | linux | >= 7cb770729ba895f73253dfcd46c3fcba45d896f9 < 6d05390d20f110de37d051a3e063ef0a542d01fb | 6d05390d20f110de37d051a3e063ef0a542d01fb |
| linux | linux | >= 7cb770729ba895f73253dfcd46c3fcba45d896f9 < 714afb4c38edd19a057d519c1f9c5d164b43de94 | 714afb4c38edd19a057d519c1f9c5d164b43de94 |
| linux | linux | >= 7cb770729ba895f73253dfcd46c3fcba45d896f9 < da1b9a55ff116cb040528ef664c70a4eec03ae99 | da1b9a55ff116cb040528ef664c70a4eec03ae99 |
| linux | linux_kernel | >= 0 < 5.10.244-1 | 5.10.244-1 |
| linux | linux_kernel | >= 0 < 6.1.147-1 | 6.1.147-1 |
| linux | linux_kernel | >= 0 < 6.12.35-1 | 6.12.35-1 |
| linux | linux_kernel | >= 0 < 6.12.35-1 | 6.12.35-1 |
| linux | linux_kernel | >= 0 < 5.15.0-156.166 | 5.15.0-156.166 |
| linux | linux_kernel | >= 0 < 6.8.0-100.100 | 6.8.0-100.100 |
| linux | linux_kernel | >= 2.6.28 < 5.4.295 | 5.4.295 |
| linux | linux_kernel | >= 5.11 < 5.15.186 | 5.15.186 |
| linux | linux_kernel | >= 5.16 < 6.1.142 | 6.1.142 |
| linux | linux_kernel | >= 5.5 < 5.10.239 | 5.10.239 |
| linux | linux_kernel | >= 6.13 < 6.15.4 | 6.15.4 |
| linux | linux_kernel | >= 6.2 < 6.6.95 | 6.6.95 |
| linux | linux_kernel | >= 6.7 < 6.12.35 | 6.12.35 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH