CVE-2025-37911

MEDIUM EPSS 5.5%
Published May 20, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published May 20, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This happens when copying the coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command. The info->dest_buf buffer is allocated based on the number of coredump segments returned by the FW. The segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver then copies this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf length and cause the above BUG condition. Fix it by capping the copy length to not exceed the length of info->dest_buf. The extra DMA data contains no useful information. This code path is shared for the HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different for these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
5.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 18

VendorProductVersionRange
linuxlinux_kernel*≥4.19.95  –  <4.20
linuxlinux_kernel*≥5.4.8  –  <5.5
linuxlinux_kernel*≥5.5.1  –  <5.15.182
linuxlinux_kernel*≥5.16  –  <6.1.138
linuxlinux_kernel*≥6.2  –  <6.6.90
linuxlinux_kernel*≥6.7  –  <6.12.28
linuxlinux_kernel*≥6.13  –  <6.14.6
linuxlinux_kernel5.5any
linuxlinux_kernel5.5any
linuxlinux_kernel5.5any
linuxlinux_kernel5.5any
linuxlinux_kernel5.5any
linuxlinux_kernel5.5any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
debiandebian_linux11.0any

References 7

  • git.kernel.org https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html
    Mailing List

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419
    Patch