CVE-2025-38585 (GCVE-0-2025-38585)

Vulnerability from cvelistv5 – Published: 2025-08-19 17:03 – Updated: 2026-05-11 21:31
VLAI?
Title
staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() When gmin_get_config_var() calls efi.get_variable() and the EFI variable is larger than the expected buffer size, two behaviors combine to create a stack buffer overflow: 1. gmin_get_config_var() does not return the proper error code when efi.get_variable() fails. It returns the stale 'ret' value from earlier operations instead of indicating the EFI failure. 2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates *out_len to the required buffer size but writes no data to the output buffer. However, due to bug #1, gmin_get_var_int() believes the call succeeded. The caller gmin_get_var_int() then performs: - Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack - Calls gmin_get_config_var(dev, is_gmin, var, val, &len) with len=64 - If EFI variable is >64 bytes, efi.get_variable() sets len=required_size - Due to bug #1, thinks call succeeded with len=required_size - Executes val[len] = 0, writing past end of 65-byte stack buffer This creates a stack buffer overflow when EFI variables are larger than 64 bytes. Since EFI variables can be controlled by firmware or system configuration, this could potentially be exploited for code execution. Fix the bug by returning proper error codes from gmin_get_config_var() based on EFI status instead of stale 'ret' value. The gmin_get_var_int() function is called during device initialization for camera sensor configuration on Intel Bay Trail and Cherry Trail platforms using the atomisp camera stack.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 38d4f74bc14847491d07bd745dc4a2c274f4987d , < 3d672fe065aa00f4d66f42e3c9720f69a3ed43e7 (git)
Affected: 38d4f74bc14847491d07bd745dc4a2c274f4987d , < e6d3453a002e89537e6136f6c774659b297a549b (git)
Affected: 38d4f74bc14847491d07bd745dc4a2c274f4987d , < 1a7a2f59fb2eb0718a0cff1e5822500cefe50ed9 (git)
Affected: 38d4f74bc14847491d07bd745dc4a2c274f4987d , < ee4cf798202d285dcbe85e4467a094c44f5ed8e6 (git)
Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.12.42 , ≤ 6.12.* (semver)
Unaffected: 6.15.10 , ≤ 6.15.* (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d672fe065aa00f4d66f42e3c9720f69a3ed43e7",
              "status": "affected",
              "version": "38d4f74bc14847491d07bd745dc4a2c274f4987d",
              "versionType": "git"
            },
            {
              "lessThan": "e6d3453a002e89537e6136f6c774659b297a549b",
              "status": "affected",
              "version": "38d4f74bc14847491d07bd745dc4a2c274f4987d",
              "versionType": "git"
            },
            {
              "lessThan": "1a7a2f59fb2eb0718a0cff1e5822500cefe50ed9",
              "status": "affected",
              "version": "38d4f74bc14847491d07bd745dc4a2c274f4987d",
              "versionType": "git"
            },
            {
              "lessThan": "ee4cf798202d285dcbe85e4467a094c44f5ed8e6",
              "status": "affected",
              "version": "38d4f74bc14847491d07bd745dc4a2c274f4987d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()\n\nWhen gmin_get_config_var() calls efi.get_variable() and the EFI variable\nis larger than the expected buffer size, two behaviors combine to create\na stack buffer overflow:\n\n1. gmin_get_config_var() does not return the proper error code when\n   efi.get_variable() fails. It returns the stale \u0027ret\u0027 value from\n   earlier operations instead of indicating the EFI failure.\n\n2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates\n   *out_len to the required buffer size but writes no data to the output\n   buffer. However, due to bug #1, gmin_get_var_int() believes the call\n   succeeded.\n\nThe caller gmin_get_var_int() then performs:\n- Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack\n- Calls gmin_get_config_var(dev, is_gmin, var, val, \u0026len) with len=64\n- If EFI variable is \u003e64 bytes, efi.get_variable() sets len=required_size\n- Due to bug #1, thinks call succeeded with len=required_size\n- Executes val[len] = 0, writing past end of 65-byte stack buffer\n\nThis creates a stack buffer overflow when EFI variables are larger than\n64 bytes. Since EFI variables can be controlled by firmware or system\nconfiguration, this could potentially be exploited for code execution.\n\nFix the bug by returning proper error codes from gmin_get_config_var()\nbased on EFI status instead of stale \u0027ret\u0027 value.\n\nThe gmin_get_var_int() function is called during device initialization\nfor camera sensor configuration on Intel Bay Trail and Cherry Trail\nplatforms using the atomisp camera stack."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:31:00.987Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d672fe065aa00f4d66f42e3c9720f69a3ed43e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6d3453a002e89537e6136f6c774659b297a549b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a7a2f59fb2eb0718a0cff1e5822500cefe50ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6"
        }
      ],
      "title": "staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38585",
    "datePublished": "2025-08-19T17:03:07.084Z",
    "dateReserved": "2025-04-16T04:51:24.026Z",
    "dateUpdated": "2026-05-11T21:31:00.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38585",
      "date": "2026-05-19",
      "epss": "0.00025",
      "percentile": "0.07258"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38585\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-19T17:15:35.877\",\"lastModified\":\"2025-11-26T17:57:33.180\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nstaging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()\\n\\nWhen gmin_get_config_var() calls efi.get_variable() and the EFI variable\\nis larger than the expected buffer size, two behaviors combine to create\\na stack buffer overflow:\\n\\n1. gmin_get_config_var() does not return the proper error code when\\n   efi.get_variable() fails. It returns the stale \u0027ret\u0027 value from\\n   earlier operations instead of indicating the EFI failure.\\n\\n2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates\\n   *out_len to the required buffer size but writes no data to the output\\n   buffer. However, due to bug #1, gmin_get_var_int() believes the call\\n   succeeded.\\n\\nThe caller gmin_get_var_int() then performs:\\n- Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack\\n- Calls gmin_get_config_var(dev, is_gmin, var, val, \u0026len) with len=64\\n- If EFI variable is \u003e64 bytes, efi.get_variable() sets len=required_size\\n- Due to bug #1, thinks call succeeded with len=required_size\\n- Executes val[len] = 0, writing past end of 65-byte stack buffer\\n\\nThis creates a stack buffer overflow when EFI variables are larger than\\n64 bytes. Since EFI variables can be controlled by firmware or system\\nconfiguration, this could potentially be exploited for code execution.\\n\\nFix the bug by returning proper error codes from gmin_get_config_var()\\nbased on EFI status instead of stale \u0027ret\u0027 value.\\n\\nThe gmin_get_var_int() function is called during device initialization\\nfor camera sensor configuration on Intel Bay Trail and Cherry Trail\\nplatforms using the atomisp camera stack.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: staging: media: atomisp: Correcci\u00f3n del desbordamiento del b\u00fafer de pila en gmin_get_var_int() Cuando gmin_get_config_var() llama a efi.get_variable() y la variable EFI es mayor que el tama\u00f1o de b\u00fafer esperado, se combinan dos comportamientos para crear un desbordamiento del b\u00fafer de pila: 1. gmin_get_config_var() no devuelve el c\u00f3digo de error correcto cuando efi.get_variable() falla. Devuelve el valor \u0027ret\u0027 obsoleto de operaciones anteriores en lugar de indicar el fallo de EFI. 2. Cuando efi.get_variable() devuelve EFI_BUFFER_TOO_SMALL, actualiza *out_len al tama\u00f1o de b\u00fafer requerido, pero no escribe datos en el b\u00fafer de salida. Sin embargo, debido al error n.\u00ba 1, gmin_get_var_int() cree que la llamada tuvo \u00e9xito. El llamador gmin_get_var_int() realiza entonces: - Asigna val[CFG_VAR_NAME_MAX + 1] (65 bytes) en la pila - Llama a gmin_get_config_var(dev, is_gmin, var, val, \u0026amp;len) con len=64 - Si la variable EFI es \u0026gt;64 bytes, efi.get_variable() establece len=required_size - Debido al error #1, piensa que la llamada tuvo \u00e9xito con len=required_size - Ejecuta val[len] = 0, escribiendo m\u00e1s all\u00e1 del final del b\u00fafer de pila de 65 bytes Esto crea un desbordamiento del b\u00fafer de pila cuando las variables EFI son mayores de 64 bytes. Dado que las variables EFI pueden ser controladas por el firmware o la configuraci\u00f3n del sistema, esto podr\u00eda ser potencialmente explotado para la ejecuci\u00f3n de c\u00f3digo. Corrija el error devolviendo los c\u00f3digos de error adecuados de gmin_get_config_var() basados en el estado de EFI en lugar del valor \u0027ret\u0027 obsoleto. La funci\u00f3n gmin_get_var_int() se llama durante la inicializaci\u00f3n del dispositivo para la configuraci\u00f3n del sensor de la c\u00e1mara en las plataformas Intel Bay Trail y Cherry Trail utilizando la pila de c\u00e1mara atomisp.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.12.42\",\"matchCriteriaId\":\"7834437B-ADB5-40E8-B1E0-F57F1A9F41A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.10\",\"matchCriteriaId\":\"5890C690-B295-40C2-9121-FF5F987E5142\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.1\",\"matchCriteriaId\":\"58182352-D7DF-4CC9-841E-03C1D852C3FB\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a7a2f59fb2eb0718a0cff1e5822500cefe50ed9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d672fe065aa00f4d66f42e3c9720f69a3ed43e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6d3453a002e89537e6136f6c774659b297a549b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.