CVE-2025-37991

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37991

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash Camm noticed that on parisc a SIGFPE exception will crash an application with a second SIGFPE in the signal handler. Dave analyzed it, and it happens because glibc uses a double-word floating-point store to atomically update function descriptors. As a result of lazy binding, we hit a floating-point store in fpe_func almost immediately. When the T bit is set, an assist exception trap occurs when when the co-processor encounters *any* floating-point instruction except for a double store of register %fr0. The latter cancels all pending traps. Let's fix this by clearing the Trap (T) bit in the FP status register before returning to the signal handler in userspace. The issue can be reproduced with this test program: root@parisc:~# cat fpe.c static void fpe_func(int sig, siginfo_t *i, void *v) { sigset_t set; sigemptyset(&set); sigaddset(&set, SIGFPE); sigprocmask(SIG_UNBLOCK, &set, NULL); printf("GOT signal %d with si_code %ld\n", sig, i->si_code); } int main() { struct sigaction action = { .sa_sigaction = fpe_func, .sa_flags = SA_RESTART|SA_SIGINFO }; sigaction(SIGFPE, &action, 0); feenableexcept(FE_OVERFLOW); return printf("%lf\n",1.7976931348623158E308*1.7976931348623158E308); } root@parisc:~# gcc fpe.c -lm root@parisc:~# ./a.out Floating point exception root@parisc:~# strace -f ./a.out execve("./a.out", ["./a.out"], 0xf9ac7034 /* 20 vars */) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0 ... rt_sigaction(SIGFPE, {sa_handler=0x1110a, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0 --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0x1078f} --- --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0xf8f21237} --- +++ killed by SIGFPE +++ Floating point exception

References
Link Resource
https://git.kernel.org/stable/c/2a1aff3616b3b57aa4a5f8a7762cce1e82493fe6 Patch
https://git.kernel.org/stable/c/6a098c51d18ec99485668da44294565c43dbc106 Patch
https://git.kernel.org/stable/c/6c639af49e9e5615a8395981eaf5943fb40acd6f Patch
https://git.kernel.org/stable/c/757ba4d17b868482837c566cfefca59e2296c608 Patch
https://git.kernel.org/stable/c/cf21e890f56b7d0038ddaf25224e4f4c69ecd143 Patch
https://git.kernel.org/stable/c/de3629baf5a33af1919dec7136d643b0662e85ef Patch
https://git.kernel.org/stable/c/df3592e493d7f29bae4ffde9a9325de50ddf962e Patch
https://git.kernel.org/stable/c/ec4584495868bd465fe60a3f771915c0e7ce7951 Patch
https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

16 Dec 2025, 20:19

Type Values Removed Values Added
First Time Linux linux Kernel
Debian
Linux
Debian debian Linux
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/2a1aff3616b3b57aa4a5f8a7762cce1e82493fe6 - () https://git.kernel.org/stable/c/2a1aff3616b3b57aa4a5f8a7762cce1e82493fe6 - Patch
References () https://git.kernel.org/stable/c/6a098c51d18ec99485668da44294565c43dbc106 - () https://git.kernel.org/stable/c/6a098c51d18ec99485668da44294565c43dbc106 - Patch
References () https://git.kernel.org/stable/c/6c639af49e9e5615a8395981eaf5943fb40acd6f - () https://git.kernel.org/stable/c/6c639af49e9e5615a8395981eaf5943fb40acd6f - Patch
References () https://git.kernel.org/stable/c/757ba4d17b868482837c566cfefca59e2296c608 - () https://git.kernel.org/stable/c/757ba4d17b868482837c566cfefca59e2296c608 - Patch
References () https://git.kernel.org/stable/c/cf21e890f56b7d0038ddaf25224e4f4c69ecd143 - () https://git.kernel.org/stable/c/cf21e890f56b7d0038ddaf25224e4f4c69ecd143 - Patch
References () https://git.kernel.org/stable/c/de3629baf5a33af1919dec7136d643b0662e85ef - () https://git.kernel.org/stable/c/de3629baf5a33af1919dec7136d643b0662e85ef - Patch
References () https://git.kernel.org/stable/c/df3592e493d7f29bae4ffde9a9325de50ddf962e - () https://git.kernel.org/stable/c/df3592e493d7f29bae4ffde9a9325de50ddf962e - Patch
References () https://git.kernel.org/stable/c/ec4584495868bd465fe60a3f771915c0e7ce7951 - () https://git.kernel.org/stable/c/ec4584495868bd465fe60a3f771915c0e7ce7951 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-415

03 Nov 2025, 20:18

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html -

04 Jun 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/2a1aff3616b3b57aa4a5f8a7762cce1e82493fe6 -
  • () https://git.kernel.org/stable/c/757ba4d17b868482837c566cfefca59e2296c608 -

21 May 2025, 20:24

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: parisc: Se corrige el doble fallo de SIGFPE Camm notó que en parisc una excepción SIGFPE bloqueará una aplicación con un segundo SIGFPE en el manejador de señales. Dave lo analizó y sucede porque glibc usa un almacén de punto flotante de doble palabra para actualizar atómicamente los descriptores de función. Como resultado del enlace diferido, llegamos a un almacén de punto flotante en fpe_func casi inmediatamente. Cuando se establece el bit T, se produce una trampa de excepción de asistencia cuando el coprocesador encuentra *cualquier* instrucción de punto flotante excepto un almacén doble del registro %fr0. Este último cancela todas las trampas pendientes. Arreglemos esto borrando el bit Trap (T) en el registro de estado FP antes de regresar al manejador de señales en el espacio de usuario. El problema se puede reproducir con este programa de prueba: root@parisc:~# cat fpe.c static void fpe_func(int sig, siginfo_t *i, void *v) { sigset_t set; sigemptyset(&set); sigaddset(&set, SIGFPE); sigprocmask(SIG_UNBLOCK, &set, NULL); printf("Señal GOT %d con código si %ld\n", sig, i->código si); } int main() { struct sigaction action = { .sa_sigaction = fpe_func, .sa_flags = SA_RESTART|SA_SIGINFO }; sigaction(SIGFPE, &action, 0); feenableexcept(FE_OVERFLOW); return printf("%lf\n",1.7976931348623158E308*1.7976931348623158E308); } root@parisc:~# gcc fpe.c -lm root@parisc:~# ./a.out Excepción de punto flotante root@parisc:~# strace -f ./a.out execve("./a.out", ["./a.out"], 0xf9ac7034 /* 20 variables */) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0 ... rt_sigaction(SIGFPE, {sa_handler=0x1110a, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0 --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0x1078f} --- --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0xf8f21237} --- +++ eliminado por SIGFPE +++ Excepción de punto flotante

20 May 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-20 18:15

Updated : 2025-12-16 20:19

NVD link : CVE-2025-37991

Mitre link : CVE-2025-37991

CVE.ORG link : CVE-2025-37991

JSON object : View

Products Affected

linux

debian

CWE
CWE-415

Double Free