{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38004", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.977Z", "datePublished": "2025-06-08T10:34:56.484Z", "dateUpdated": "2026-08-05T11:58:55.616Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:55.616Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking for bcm_op runtime updates\n\nThe CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via\nhrtimer. The content and also the length of the sequence can be changed\nresp reduced at runtime where the 'currframe' counter is then set to zero.\n\nAlthough this appeared to be a safe operation the updates of 'currframe'\ncan be triggered from user space and hrtimer context in bcm_can_tx().\nAnderson Nascimento created a proof of concept that triggered a KASAN\nslab-out-of-bounds read access which can be prevented with a spin_lock_bh.\n\nAt the rework of bcm_can_tx() the 'count' variable has been moved into\nthe protected section as this variable can be modified from both contexts\ntoo." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires a local `socket(PF_CAN, SOCK_DGRAM, CAN_BCM)` and concurrent `sendmsg()` calls; the race is between the local socket's user context and the local hrtimer softirq, with no remote input involved.\nAC:L - The attacker controls both sides of the race — arming the hrtimer with a 1 µs `ival` (allowed by `bcm_is_invalid_tv()`) to spin `bcm_can_tx()` in softirq while looping `TX_SETUP|TX_ANNOUNCE` sendmsg on another CPU; a working PoC was written and tested by the reporter.\nPR:L - `can_create()` performs no capability check and `can-bcm` is module-autoloaded on socket creation, so any unprivileged local user can reach `bcm_tx_setup()`; the required CAN netdev exists by default on automotive/industrial targets and is otherwise creatable via `unshare -Urn` plus vcan.\nUI:N - The attacker triggers the entire sequence from its own process — socket creation, timer arming, and the concurrent TX_SETUP updates — with no victim action required.\nS:U - The out-of-bounds read, the leaked pointers, and the counter underflow are all confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The OOB read is not merely detected by KASAN — the stale-heap bytes are copied into an skb and looped back by `can_send(skb, 1)`, so up to 72 bytes of adjacent slab memory per iteration, including the `op->sk` and `op->rx_reg_dev` kernel pointers, are delivered to a userspace `CAN_RAW` socket, giving a repeatable heap/KASLR disclosure primitive.\nI:L - No out-of-bounds write primitive exists (`currframe` is only a read index), but the unsynchronized `op->count--` from both contexts corrupts kernel state by underflowing the u32 counter, and `op->currframe` itself is left in an invalid out-of-range state, causing the kernel to emit frames it was never instructed to send.\nA:H - The `op->count` underflow to 0xFFFFFFFF makes `bcm_tx_set_expiry()` re-arm indefinitely at a 1 µs interval, producing a persistent softirq/TX flood that starves the CPU, and the slab-out-of-bounds access panics KASAN/hardened kernels outright." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/can/bcm.c" ], "versions": [ { "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "8f1c022541bf5a923c8d6fa483112c15250f30a4", "status": "affected", "versionType": "git" }, { "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "7595de7bc56e0e52b74e56c90f7e247bf626d628", "status": "affected", "versionType": "git" }, { "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f", "status": "affected", "versionType": "git" }, { "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "2a437b86ac5a9893c902f30ef66815bf13587bf6", "status": "affected", "versionType": "git" }, { "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "76c84c3728178b2d38d5604e399dfe8b0752645e", "status": "affected", "versionType": "git" }, { "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "cc55dd28c20a6611e30596019b3b2f636819a4c0", "status": "affected", "versionType": "git" }, { "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd", "status": "affected", "versionType": "git" }, { "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/can/bcm.c" ], "versions": [ { "version": "2.6.25", "status": "affected" }, { "version": "0", "lessThan": "2.6.25", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.185", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.141", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.93", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.31", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.9", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.4.294" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.10.238" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.15.185" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.1.141" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.6.93" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.12.31" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.14.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8f1c022541bf5a923c8d6fa483112c15250f30a4" }, { "url": "https://git.kernel.org/stable/c/7595de7bc56e0e52b74e56c90f7e247bf626d628" }, { "url": "https://git.kernel.org/stable/c/fbd8fdc2b218e979cfe422b139b8f74c12419d1f" }, { "url": "https://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6" }, { "url": "https://git.kernel.org/stable/c/76c84c3728178b2d38d5604e399dfe8b0752645e" }, { "url": "https://git.kernel.org/stable/c/cc55dd28c20a6611e30596019b3b2f636819a4c0" }, { "url": "https://git.kernel.org/stable/c/c4e8a172501e677ebd8ea9d9161d97dc4df56fbd" }, { "url": "https://git.kernel.org/stable/c/c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7" } ], "title": "can: bcm: add locking for bcm_op runtime updates", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:33:04.853Z" } } ] } }