CVE-2025-37911 (GCVE-0-2025-37911)
Vulnerability from cvelistv5
Published
2025-05-20 15:21
Modified
2025-05-26 05:23
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This happens when copying the coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command. The info->dest_buf buffer is allocated based on the number of coredump segments returned by the FW. The segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver then copies this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf length and cause the above BUG condition. Fix it by capping the copy length to not exceed the length of info->dest_buf. The extra DMA data contains no useful information. This code path is shared for the HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different for these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419
Impacted products
Vendor Product Version
Linux Linux Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: 4bf973a1f84aefb64750bdb3afe72d54de3199d7
Version: a76837dd731b68cc3b5690470bc9efa2a8e3801a
 Create a notification for this product.
   Linux Linux Version: 5.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69b10dd23ab826d0c7f2d9ab311842251978d0c1",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "43292b83424158fa6ec458799f3cb9c54d18c484",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "4d69864915a3a052538e4ba76cd6fd77cfc64ebe",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "44807af79efd0d78fa36383dd865ddfe7992c0a6",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "44d81a9ebf0cad92512e0ffdf7412bfe20db66ec",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "6b87bd94f34370bbf1dfa59352bed8efab5bf419",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bf973a1f84aefb64750bdb3afe72d54de3199d7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a76837dd731b68cc3b5690470bc9efa2a8e3801a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.182",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.138",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\n\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\nmemory corruption:\n\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nethtool_get_dump_data+0xdc/0x1a0\n__dev_ethtool+0xa1e/0x1af0\ndev_ethtool+0xa8/0x170\ndev_ioctl+0x1b5/0x580\nsock_do_ioctl+0xab/0xf0\nsock_ioctl+0x1ce/0x2e0\n__x64_sys_ioctl+0x87/0xc0\ndo_syscall_64+0x5c/0xf0\nentry_SYSCALL_64_after_hwframe+0x78/0x80\n\n...\n\nThis happens when copying the coredump segment list in\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\nThe info-\u003edest_buf buffer is allocated based on the number of coredump\nsegments returned by the FW.  The segment list is then DMA\u0027ed by\nthe FW and the length of the DMA is returned by FW.  The driver then\ncopies this DMA\u0027ed segment list to info-\u003edest_buf.\n\nIn some cases, this DMA length may exceed the info-\u003edest_buf length\nand cause the above BUG condition.  Fix it by capping the copy\nlength to not exceed the length of info-\u003edest_buf.  The extra\nDMA data contains no useful information.\n\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\nHWRM_DBG_COREDUMP_RETRIEVE FW commands.  The buffering is different\nfor these 2 FW commands.  To simplify the logic, we need to move\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\nup, so that the new check to cap the copy length will work for both\ncommands."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T05:23:32.646Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe"
        },
        {
          "url": "https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419"
        }
      ],
      "title": "bnxt_en: Fix out-of-bound memcpy() during ethtool -w",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37911",
    "datePublished": "2025-05-20T15:21:43.278Z",
    "dateReserved": "2025-04-16T04:51:23.967Z",
    "dateUpdated": "2025-05-26T05:23:32.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37911\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:27.610\",\"lastModified\":\"2025-05-21T20:25:16.407\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\\n\\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\\nmemory corruption:\\n\\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\\nethtool_get_dump_data+0xdc/0x1a0\\n__dev_ethtool+0xa1e/0x1af0\\ndev_ethtool+0xa8/0x170\\ndev_ioctl+0x1b5/0x580\\nsock_do_ioctl+0xab/0xf0\\nsock_ioctl+0x1ce/0x2e0\\n__x64_sys_ioctl+0x87/0xc0\\ndo_syscall_64+0x5c/0xf0\\nentry_SYSCALL_64_after_hwframe+0x78/0x80\\n\\n...\\n\\nThis happens when copying the coredump segment list in\\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\\nThe info-\u003edest_buf buffer is allocated based on the number of coredump\\nsegments returned by the FW.  The segment list is then DMA\u0027ed by\\nthe FW and the length of the DMA is returned by FW.  The driver then\\ncopies this DMA\u0027ed segment list to info-\u003edest_buf.\\n\\nIn some cases, this DMA length may exceed the info-\u003edest_buf length\\nand cause the above BUG condition.  Fix it by capping the copy\\nlength to not exceed the length of info-\u003edest_buf.  The extra\\nDMA data contains no useful information.\\n\\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\\nHWRM_DBG_COREDUMP_RETRIEVE FW commands.  The buffering is different\\nfor these 2 FW commands.  To simplify the logic, we need to move\\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\\nup, so that the new check to cap the copy length will work for both\\ncommands.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.