CVE-2025-37960

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37960
In the Linux kernel, the following vulnerability has been resolved: memblock: Accept allocated memory before use in memblock_double_array() When increasing the array size in memblock_double_array() and the slab is not yet available, a call to memblock_find_in_range() is used to reserve/allocate memory. However, the range returned may not have been accepted, which can result in a crash when booting an SNP guest: RIP: 0010:memcpy_orig+0x68/0x130 Code: ... RSP: 0000:ffffffff9cc03ce8 EFLAGS: 00010006 RAX: ff11001ff83e5000 RBX: 0000000000000000 RCX: fffffffffffff000 RDX: 0000000000000bc0 RSI: ffffffff9dba8860 RDI: ff11001ff83e5c00 RBP: 0000000000002000 R08: 0000000000000000 R09: 0000000000002000 R10: 000000207fffe000 R11: 0000040000000000 R12: ffffffff9d06ef78 R13: ff11001ff83e5000 R14: ffffffff9dba7c60 R15: 0000000000000c00 memblock_double_array+0xff/0x310 memblock_add_range+0x1fb/0x2f0 memblock_reserve+0x4f/0xa0 memblock_alloc_range_nid+0xac/0x130 memblock_alloc_internal+0x53/0xc0 memblock_alloc_try_nid+0x3d/0xa0 swiotlb_init_remap+0x149/0x2f0 mem_init+0xb/0xb0 mm_core_init+0x8f/0x350 start_kernel+0x17e/0x5d0 x86_64_start_reservations+0x14/0x30 x86_64_start_kernel+0x92/0xa0 secondary_startup_64_no_verify+0x194/0x19b Mitigate this by calling accept_memory() on the memory range returned before the slab is available. Prior to v6.12, the accept_memory() interface used a 'start' and 'end' parameter instead of 'start' and 'size', therefore the accept_memory() call must be adjusted to specify 'start + size' for 'end' when applying to kernels prior to v6.12.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/7bcd29181bab8d508d2adfdbb132de8b1e088698 Patch
https://git.kernel.org/stable/c/aa513e69e011a2b19fa22ce62ce35effbd5e0c81 Patch
https://git.kernel.org/stable/c/d66a22f6a432a9dd376c9b365d7dc89bd416909c Patch
https://git.kernel.org/stable/c/da8bf5daa5e55a6af2b285ecda460d6454712ff4 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
History

14 Nov 2025, 17:02

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/7bcd29181bab8d508d2adfdbb132de8b1e088698 - () https://git.kernel.org/stable/c/7bcd29181bab8d508d2adfdbb132de8b1e088698 - Patch
References () https://git.kernel.org/stable/c/aa513e69e011a2b19fa22ce62ce35effbd5e0c81 - () https://git.kernel.org/stable/c/aa513e69e011a2b19fa22ce62ce35effbd5e0c81 - Patch
References () https://git.kernel.org/stable/c/d66a22f6a432a9dd376c9b365d7dc89bd416909c - () https://git.kernel.org/stable/c/d66a22f6a432a9dd376c9b365d7dc89bd416909c - Patch
References () https://git.kernel.org/stable/c/da8bf5daa5e55a6af2b285ecda460d6454712ff4 - () https://git.kernel.org/stable/c/da8bf5daa5e55a6af2b285ecda460d6454712ff4 - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
CWE NVD-CWE-noinfo

22 May 2025, 13:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: memblock: aceptar memoria asignada antes de su uso en memblock_double_array(). Al aumentar el tamaño de la matriz en memblock_double_array() y la losa aún no está disponible, se utiliza una llamada a memblock_find_in_range() para reservar/asignar memoria. Sin embargo, es posible que no se haya aceptado el rango devuelto, lo que puede provocar un bloqueo al iniciar un invitado SNP: RIP: 0010:memcpy_orig+0x68/0x130 Código: ... RSP: 0000:ffffffff9cc03ce8 EFLAGS: 00010006 RAX: ff11001ff83e5000 RBX: 0000000000000000 RCX: fffffffffffff000 RDX: 0000000000000bc0 RSI: ffffffff9dba8860 RDI: ff11001ff83e5c00 RBP: 0000000000002000 R08: 000000000000000 R09: 0000000000002000 R10: 000000207fffe000 R11: 0000040000000000 R12: ffffffff9d06ef78 R13: ff11001ff83e5000 R14: ffffffff9dba7c60 R15: 0000000000000c00 memblock_double_array+0xff/0x310 memblock_add_range+0x1fb/0x2f0 memblock_reserve+0x4f/0xa0 memblock_alloc_range_nid+0xac/0x130 memblock_alloc_internal+0x53/0xc0 memblock_alloc_try_nid+0x3d/0xa0 swiotlb_init_remap+0x149/0x2f0 mem_init+0xb/0xb0 mm_core_init+0x8f/0x350 start_kernel+0x17e/0x5d0 x86_64_start_reservations+0x14/0x30 x86_64_start_kernel+0x92/0xa0 secondary_startup_64_no_verify+0x194/0x19b Para mitigar este problema, llame a accept_memory() en el rango de memoria devuelto antes de que el slab esté disponible. Antes de la versión 6.12, la interfaz accept_memory() utilizaba los parámetros "start" y "end" en lugar de "start" y "size". Por lo tanto, la llamada a accept_memory() debe ajustarse para especificar "start + size" en lugar de "end" al aplicarlo a kernels anteriores a la versión 6.12.
References
  • () https://git.kernel.org/stable/c/7bcd29181bab8d508d2adfdbb132de8b1e088698 -

20 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-20 16:15

Updated : 2025-11-14 17:02

NVD link : CVE-2025-37960

Mitre link : CVE-2025-37960

CVE.ORG link : CVE-2025-37960

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo