CVE-2025-40114

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-40114
In the Linux kernel, the following vulnerability has been resolved: iio: light: Add check for array bounds in veml6075_read_int_time_ms The array contains only 5 elements, but the index calculated by veml6075_read_int_time_index can range from 0 to 7, which could lead to out-of-bounds access. The check prevents this issue. Coverity Issue CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN) overrun-local: Overrunning array veml6075_it_ms of 5 4-byte elements at element index 7 (byte offset 31) using index int_index (which evaluates to 7) This is hardening against potentially broken hardware. Good to have but not necessary to backport.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/18a08b5632809faa671279b3cd27d5f96cc5a3f0 Patch
https://git.kernel.org/stable/c/7a40b52d4442178bee0cf1c36bc450ab951cef0f Patch
https://git.kernel.org/stable/c/9c40a68b7f97fa487e6c7e67fcf4f846a1f96692 Patch
https://git.kernel.org/stable/c/ee735aa33db16c1fb5ebccbaf84ad38f5583f3cc Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

29 Apr 2025, 13:46

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/18a08b5632809faa671279b3cd27d5f96cc5a3f0 - () https://git.kernel.org/stable/c/18a08b5632809faa671279b3cd27d5f96cc5a3f0 - Patch
References () https://git.kernel.org/stable/c/7a40b52d4442178bee0cf1c36bc450ab951cef0f - () https://git.kernel.org/stable/c/7a40b52d4442178bee0cf1c36bc450ab951cef0f - Patch
References () https://git.kernel.org/stable/c/9c40a68b7f97fa487e6c7e67fcf4f846a1f96692 - () https://git.kernel.org/stable/c/9c40a68b7f97fa487e6c7e67fcf4f846a1f96692 - Patch
References () https://git.kernel.org/stable/c/ee735aa33db16c1fb5ebccbaf84ad38f5583f3cc - () https://git.kernel.org/stable/c/ee735aa33db16c1fb5ebccbaf84ad38f5583f3cc - Patch
CWE CWE-129
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iio: light: Agregar comprobación de los límites de matriz en veml6075_read_int_time_ms La matriz contiene solo 5 elementos, pero el índice calculado por veml6075_read_int_time_index puede variar de 0 a 7, lo que podría provocar un acceso fuera de los límites. La comprobación evita este problema. Coverity Issue CID 1574309: (#1 de 1): Lectura fuera de los límites (OVERRUN) overrun-local: Desbordamiento de la matriz veml6075_it_ms de 5 elementos de 4 bytes en el índice de elemento 7 (desplazamiento de byte 31) utilizando el índice int_index (que evalúa a 7) Esto es endurecimiento contra hardware potencialmente dañado. Es bueno tenerlo, pero no es necesario retroportarlo.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

18 Apr 2025, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-18 07:15

Updated : 2025-04-29 13:46

NVD link : CVE-2025-40114

Mitre link : CVE-2025-40114

CVE.ORG link : CVE-2025-40114

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-129

Improper Validation of Array Index