{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21915", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.787Z", "datePublished": "2025-04-01T15:40:52.019Z", "dateUpdated": "2026-08-05T11:55:19.720Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:19.720Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncdx: Fix possible UAF error in driver_override_show()\n\nFixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c\n\nThis function driver_override_show() is part of DEVICE_ATTR_RW, which\nincludes both driver_override_show() and driver_override_store().\nThese functions can be executed concurrently in sysfs.\n\nThe driver_override_store() function uses driver_set_override() to\nupdate the driver_override value, and driver_set_override() internally\nlocks the device (device_lock(dev)). If driver_override_show() reads\ncdx_dev->driver_override without locking, it could potentially access\na freed pointer if driver_override_store() frees the string\nconcurrently. This could lead to printing a kernel address, which is a\nsecurity risk since DEVICE_ATTR can be read by all users.\n\nAdditionally, a similar pattern is used in drivers/amba/bus.c, as well\nas many other bus drivers, where device_lock() is taken in the show\nfunction, and it has been working without issues.\n\nThis potential bug was detected by our experimental static analysis\ntool, which analyzes locking APIs and paired functions to identify\ndata races and atomicity violations." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached only by read(2) on the local sysfs attribute /sys/bus/cdx/devices//driver_override; no network, adjacent-network, or physical vector reaches driver_override_show().\nAC:H - The dangling read is only possible in the narrow window during which a privileged writer (driver_override_store()/device teardown) frees the old string, and the attacker cannot induce that write — plus CDX_BUS is a non-default, platform-specific config (OF && ARM64, absent from arm64 defconfig).\nPR:L - The exploiting side of the race is the read, and DEVICE_ATTR_RW creates the file mode 0644, so any unprivileged local user can open and repeatedly read it — the upstream fix explicitly cites \"DEVICE_ATTR can be read by all users\" as the security risk.\nUI:N - The attacker's own read loop needs no victim action; the concurrent override write occurs during routine automated device bind/unbind (udev/orchestration) rather than requiring a user to be tricked into anything, and the timing dependency is already charged under AC:H.\nS:U - The freed memory and the leaking sysfs read are both in the kernel's own security authority on the same host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - vsnprintf(\"%s\") walks the freed slab object until a NUL byte, so up to a full PAGE_SIZE of reallocated kernel heap — including kernel pointers and whatever objects landed in the freed kmalloc slot — is copied verbatim to any unprivileged reader, defeating KASLR and disclosing arbitrary adjacent kernel data.\nI:H - This is a CWE-416 use-after-free on a heap object whose contents the attacker can influence by spraying the freed kmalloc slot; per UAF handling the integrity impact is High, and the disclosed heap/pointer state directly enables control-flow-hijack chains against the same kernel.\nA:H - Dereferencing the freed pointer can oops — under KASAN/panic_on_warn it panics immediately, and with SLUB poisoning (no NUL in the 0x6b fill) the string walk can run off the slab page into unmapped memory, faulting in kernel context." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/cdx/cdx.c" ], "versions": [ { "version": "2959ab247061e67485d83b6af8feb3761ec08cb9", "lessThan": "d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf", "status": "affected", "versionType": "git" }, { "version": "2959ab247061e67485d83b6af8feb3761ec08cb9", "lessThan": "8473135f89c0949436a22adb05b8cece2fb3da91", "status": "affected", "versionType": "git" }, { "version": "2959ab247061e67485d83b6af8feb3761ec08cb9", "lessThan": "0439d541aa8d3444ad41c39e39eb71acb57acde3", "status": "affected", "versionType": "git" }, { "version": "2959ab247061e67485d83b6af8feb3761ec08cb9", "lessThan": "91d44c1afc61a2fec37a9c7a3485368309391e0b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/cdx/cdx.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.83", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.19", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.7", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.13.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf" }, { "url": "https://git.kernel.org/stable/c/8473135f89c0949436a22adb05b8cece2fb3da91" }, { "url": "https://git.kernel.org/stable/c/0439d541aa8d3444ad41c39e39eb71acb57acde3" }, { "url": "https://git.kernel.org/stable/c/91d44c1afc61a2fec37a9c7a3485368309391e0b" } ], "title": "cdx: Fix possible UAF error in driver_override_show()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-21915", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-04-21T14:57:30.156471Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-21T15:01:46.061Z" } } ] } }