CVE-2025-39684

{"id": "CVE-2025-39684", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "868a1b68dcd9f2805bb86aa64862402f785d8c4a", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "ff4a7c18799c7fe999fa56c5cf276e13866b8c1a", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "d84f6e77ebe3359394df32ecd97e0d76a25283dc", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "f3b0c9ec54736f3b8118f93a473d22e11ee65743", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "aecf0d557ddd95ce68193a5ee1dc4c87415ff08a", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "3cd212e895ca2d58963fdc6422502b10dd3966bb", "versionType": "git"}], "programFiles": ["drivers/comedi/comedi_fops.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.29"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.29", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.190", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.149", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.103", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.44", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.4", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/comedi/comedi_fops.c"], "defaultStatus": "affected"}]}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "affectedData": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-09-05T18:15:45.020", "references": [{"url": "https://git.kernel.org/stable/c/3cd212e895ca2d58963fdc6422502b10dd3966bb", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/868a1b68dcd9f2805bb86aa64862402f785d8c4a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/aecf0d557ddd95ce68193a5ee1dc4c87415ff08a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d84f6e77ebe3359394df32ecd97e0d76a25283dc", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f3b0c9ec54736f3b8118f93a473d22e11ee65743", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ff4a7c18799c7fe999fa56c5cf276e13866b8c1a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-908"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()\n\nsyzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel\nbuffer is allocated to hold `insn->n` samples (each of which is an\n`unsigned int`). For some instruction types, `insn->n` samples are\ncopied back to user-space, unless an error code is being returned. The\nproblem is that not all the instruction handlers that need to return\ndata to userspace fill in the whole `insn->n` samples, so that there is\nan information leak. There is a similar syzbot report for\n`do_insnlist_ioctl()`, although it does not have a reproducer for it at\nthe time of writing.\n\nOne culprit is `insn_rw_emulate_bits()` which is used as the handler for\n`INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have\na specific handler for that instruction, but do have an `INSN_BITS`\nhandler. For `INSN_READ` it only fills in at most 1 sample, so if\n`insn->n` is greater than 1, the remaining `insn->n - 1` samples copied\nto userspace will be uninitialized kernel data.\n\nAnother culprit is `vm80xx_ai_insn_read()` in the \"vm80xx\" driver. It\nnever returns an error, even if it fails to fill the buffer.\n\nFix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure\nthat uninitialized parts of the allocated buffer are zeroed before\nhandling each instruction.\n\nThanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix\nreplaced the call to `kmalloc_array()` with `kcalloc()`, but it is not\nalways necessary to clear the whole buffer."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncomedi: Correcci\u00f3n del uso de memoria no inicializada en do_insn_ioctl() y do_insnlist_ioctl()\n\nsyzbot informa de una fuga de informaci\u00f3n del kernel (kernel-infoleak) de KMSAN en 'do_insn_ioctl()'. Se asigna un b\u00fafer del kernel para contener 'insn->n' muestras (cada una de las cuales es un 'unsigned int'). Para algunos tipos de instrucci\u00f3n, se copian 'insn->n' muestras de vuelta al espacio de usuario, a menos que se est\u00e9 devolviendo un c\u00f3digo de error. El problema es que no todos los gestores de instrucci\u00f3n que necesitan devolver datos al espacio de usuario rellenan la totalidad de las 'insn->n' muestras, de modo que hay una fuga de informaci\u00f3n. Hay un informe similar de syzbot para 'do_insnlist_ioctl()', aunque no tiene un reproductor para ello en el momento de escribir esto.\n\nUn culpable es 'insn_rw_emulate_bits()' que se utiliza como gestor para instrucciones 'INSN_READ' o 'INSN_WRITE' para subdispositivos que no tienen un gestor espec\u00edfico para esa instrucci\u00f3n, pero s\u00ed tienen un gestor 'INSN_BITS'. Para 'INSN_READ' solo rellena como m\u00e1ximo 1 muestra, as\u00ed que si 'insn->n' es mayor que 1, las 'insn->n - 1' muestras restantes copiadas al espacio de usuario ser\u00e1n datos del kernel no inicializados.\n\nOtro culpable es 'vm80xx_ai_insn_read()' en el controlador 'vm80xx'. Nunca devuelve un error, incluso si falla al rellenar el b\u00fafer.\n\nSe corrige en 'do_insn_ioctl()' y 'do_insnlist_ioctl()' asegur\u00e1ndose de que las partes no inicializadas del b\u00fafer asignado se pongan a cero antes de manejar cada instrucci\u00f3n.\n\nGracias a Arnaud Lecomte por su correcci\u00f3n a 'do_insn_ioctl()'. Esa correcci\u00f3n reemplaz\u00f3 la llamada a 'kmalloc_array()' por 'kcalloc()', pero no siempre es necesario limpiar todo el b\u00fafer."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70E10630-7292-4897-AF36-D7AF74FE096A", "versionEndExcluding": "5.15.190", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8", "versionEndExcluding": "6.1.149", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48", "versionEndExcluding": "6.6.103", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12351F24-1133-4775-960C-F2B47E81298B", "versionEndExcluding": "6.12.44", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D", "versionEndExcluding": "6.16.4", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}