CVE-2025-37923

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37923

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() syzbot reported this bug: ================================================================== BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline] BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260 CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106 trace_seq_to_buffer kernel/trace/trace.c:1830 [inline] tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 .... ================================================================== It has been reported that trace_seq_to_buffer() tries to copy more data than PAGE_SIZE to buf. Therefore, to prevent this, we should use the smaller of trace_seq_used(&iter->seq) and PAGE_SIZE as an argument.

References
Link Resource
https://git.kernel.org/stable/c/056ebbddb8faf4ddf83d005454dd78fc25c2d897 Patch
https://git.kernel.org/stable/c/1a3f9482b50b74fa9421bff8ceecfefd0dc06f8f Patch
https://git.kernel.org/stable/c/1f27a3e93b8d674b24b27fcdbc6f72743cd96c0d Patch
https://git.kernel.org/stable/c/441021e5b3c7d9bd1b963590652c415929f3b157 Patch
https://git.kernel.org/stable/c/665ce421041890571852422487f4c613d1824ba9 Patch
https://git.kernel.org/stable/c/c5d2b66c5ef5037b4b4360e5447605ff00ba1bd4 Patch
https://git.kernel.org/stable/c/f4b0174e9f18aaba59ee6ffdaf8827a7f94eb606 Patch
https://git.kernel.org/stable/c/f5178c41bb43444a6008150fe6094497135d07cb Patch
https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

10 Nov 2025, 20:58

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/056ebbddb8faf4ddf83d005454dd78fc25c2d897 - () https://git.kernel.org/stable/c/056ebbddb8faf4ddf83d005454dd78fc25c2d897 - Patch
References () https://git.kernel.org/stable/c/1a3f9482b50b74fa9421bff8ceecfefd0dc06f8f - () https://git.kernel.org/stable/c/1a3f9482b50b74fa9421bff8ceecfefd0dc06f8f - Patch
References () https://git.kernel.org/stable/c/1f27a3e93b8d674b24b27fcdbc6f72743cd96c0d - () https://git.kernel.org/stable/c/1f27a3e93b8d674b24b27fcdbc6f72743cd96c0d - Patch
References () https://git.kernel.org/stable/c/441021e5b3c7d9bd1b963590652c415929f3b157 - () https://git.kernel.org/stable/c/441021e5b3c7d9bd1b963590652c415929f3b157 - Patch
References () https://git.kernel.org/stable/c/665ce421041890571852422487f4c613d1824ba9 - () https://git.kernel.org/stable/c/665ce421041890571852422487f4c613d1824ba9 - Patch
References () https://git.kernel.org/stable/c/c5d2b66c5ef5037b4b4360e5447605ff00ba1bd4 - () https://git.kernel.org/stable/c/c5d2b66c5ef5037b4b4360e5447605ff00ba1bd4 - Patch
References () https://git.kernel.org/stable/c/f4b0174e9f18aaba59ee6ffdaf8827a7f94eb606 - () https://git.kernel.org/stable/c/f4b0174e9f18aaba59ee6ffdaf8827a7f94eb606 - Patch
References () https://git.kernel.org/stable/c/f5178c41bb43444a6008150fe6094497135d07cb - () https://git.kernel.org/stable/c/f5178c41bb43444a6008150fe6094497135d07cb - Patch
References () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Mailing List, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Debian
Linux linux Kernel
Debian debian Linux
Linux
CWE CWE-787

03 Nov 2025, 20:18

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html -

03 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -

04 Jun 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/665ce421041890571852422487f4c613d1824ba9 -
  • () https://git.kernel.org/stable/c/f4b0174e9f18aaba59ee6ffdaf8827a7f94eb606 -

21 May 2025, 20:25

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rastreo: Se corrige la escritura fuera de los límite en trace_seq_to_buffer() syzbot informó este error: ====================================================================== ERROR: KASAN: slab-out-of-bounds en trace_seq_to_buffer kernel/trace/trace.c:1830 [en línea] ERROR: KASAN: slab-out-of-bounds en tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 Escritura de tamaño 4507 en la dirección ffff888032b6b000 por tarea syz.2.320/7260 CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 No contaminado 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full) Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Seguimiento de llamadas: __dump_stack lib/dump_stack.c:94 [en línea] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [en línea] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [en línea] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106 trace_seq_to_buffer kernel/trace/trace.c:1830 [en línea] tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 .... ===================================================================== Se ha informado que trace_seq_to_buffer() intenta copiar más datos que PAGE_SIZE a buf. Por lo tanto, para evitarlo, debemos usar el valor menor entre trace_seq_used(&amp;iter-&gt;seq) y PAGE_SIZE como argumento.

20 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-20 16:15

Updated : 2025-11-10 20:58

NVD link : CVE-2025-37923

Mitre link : CVE-2025-37923

CVE.ORG link : CVE-2025-37923

JSON object : View

Products Affected

linux

debian

CWE
CWE-787

Out-of-bounds Write