CVE-2025-37838

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37838
In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function within the ssip_pn_ops structure is capable of starting the work. If we remove the module which will call ssi_protocol_remove() to make a cleanup, it will free ssi through kfree(ssi), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | ssip_xmit_work ssi_protocol_remove | kfree(ssi); | | struct hsi_client *cl = ssi->cl; | // use ssi Fix it by ensuring that the work is canceled before proceeding with the cleanup in ssi_protocol_remove().

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4b4194c9a7a8f92db39e8e86c85f4fb12ebbec4f Patch
https://git.kernel.org/stable/c/58eb29dba712ab0f13af59ca2fe545f5ce360e78 Patch
https://git.kernel.org/stable/c/834e602d0cc7c743bfce734fad4a46cefc0f9ab1 Patch
https://git.kernel.org/stable/c/ae5a6a0b425e8f76a9f0677e50796e494e89b088 Patch
https://git.kernel.org/stable/c/d58493832e284f066e559b8da5ab20c15a2801d3 Patch
https://git.kernel.org/stable/c/e3f88665a78045fe35c7669d2926b8d97b892c11 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

25 Apr 2025, 18:40

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/4b4194c9a7a8f92db39e8e86c85f4fb12ebbec4f - () https://git.kernel.org/stable/c/4b4194c9a7a8f92db39e8e86c85f4fb12ebbec4f - Patch
References () https://git.kernel.org/stable/c/58eb29dba712ab0f13af59ca2fe545f5ce360e78 - () https://git.kernel.org/stable/c/58eb29dba712ab0f13af59ca2fe545f5ce360e78 - Patch
References () https://git.kernel.org/stable/c/834e602d0cc7c743bfce734fad4a46cefc0f9ab1 - () https://git.kernel.org/stable/c/834e602d0cc7c743bfce734fad4a46cefc0f9ab1 - Patch
References () https://git.kernel.org/stable/c/ae5a6a0b425e8f76a9f0677e50796e494e89b088 - () https://git.kernel.org/stable/c/ae5a6a0b425e8f76a9f0677e50796e494e89b088 - Patch
References () https://git.kernel.org/stable/c/d58493832e284f066e559b8da5ab20c15a2801d3 - () https://git.kernel.org/stable/c/d58493832e284f066e559b8da5ab20c15a2801d3 - Patch
References () https://git.kernel.org/stable/c/e3f88665a78045fe35c7669d2926b8d97b892c11 - () https://git.kernel.org/stable/c/e3f88665a78045fe35c7669d2926b8d97b892c11 - Patch

25 Apr 2025, 11:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/58eb29dba712ab0f13af59ca2fe545f5ce360e78 -
  • () https://git.kernel.org/stable/c/d58493832e284f066e559b8da5ab20c15a2801d3 -

21 Apr 2025, 15:16

Type Values Removed Values Added
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HSI: ssi_protocol: Se corrige la vulnerabilidad de use-after-free en el controlador ssi_protocol debido a la condición de ejecución en la función ssi_protocol_probe(), &ssi->work está enlazada con ssip_xmit_work(), En ssip_pn_setup(), la función ssip_pn_xmit() dentro de la estructura ssip_pn_ops es capaz de iniciar el trabajo. Si eliminamos el módulo que llamará a ssi_protocol_remove() para hacer una limpieza, liberará ssi a través de kfree(ssi), mientras que el trabajo mencionado anteriormente se utilizará. La secuencia de operaciones que puede llevar a un error de UAF es la siguiente: CPU0 CPU1 | ssip_xmit_work ssi_protocol_remove | kfree(ssi); | | struct hsi_client *cl = ssi->cl; | // use ssi Corríjalo asegurándose de que el trabajo se cancele antes de continuar con la limpieza en ssi_protocol_remove().

20 Apr 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-18 15:15

Updated : 2025-04-25 18:40

NVD link : CVE-2025-37838

Mitre link : CVE-2025-37838

CVE.ORG link : CVE-2025-37838

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free