CVE-2025-38585 (GCVE-0-2025-38585)
Vulnerability from cvelistv5
Published
2025-08-19 17:03
Modified
2025-08-19 17:03
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() When gmin_get_config_var() calls efi.get_variable() and the EFI variable is larger than the expected buffer size, two behaviors combine to create a stack buffer overflow: 1. gmin_get_config_var() does not return the proper error code when efi.get_variable() fails. It returns the stale 'ret' value from earlier operations instead of indicating the EFI failure. 2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates *out_len to the required buffer size but writes no data to the output buffer. However, due to bug #1, gmin_get_var_int() believes the call succeeded. The caller gmin_get_var_int() then performs: - Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack - Calls gmin_get_config_var(dev, is_gmin, var, val, &len) with len=64 - If EFI variable is >64 bytes, efi.get_variable() sets len=required_size - Due to bug #1, thinks call succeeded with len=required_size - Executes val[len] = 0, writing past end of 65-byte stack buffer This creates a stack buffer overflow when EFI variables are larger than 64 bytes. Since EFI variables can be controlled by firmware or system configuration, this could potentially be exploited for code execution. Fix the bug by returning proper error codes from gmin_get_config_var() based on EFI status instead of stale 'ret' value. The gmin_get_var_int() function is called during device initialization for camera sensor configuration on Intel Bay Trail and Cherry Trail platforms using the atomisp camera stack.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1a7a2f59fb2eb0718a0cff1e5822500cefe50ed9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3d672fe065aa00f4d66f42e3c9720f69a3ed43e7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e6d3453a002e89537e6136f6c774659b297a549b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6
Impacted products
Vendor Product Version
Linux Linux Version: 38d4f74bc14847491d07bd745dc4a2c274f4987d
Version: 38d4f74bc14847491d07bd745dc4a2c274f4987d
Version: 38d4f74bc14847491d07bd745dc4a2c274f4987d
Version: 38d4f74bc14847491d07bd745dc4a2c274f4987d
 Create a notification for this product.
   Linux Linux Version: 6.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d672fe065aa00f4d66f42e3c9720f69a3ed43e7",
              "status": "affected",
              "version": "38d4f74bc14847491d07bd745dc4a2c274f4987d",
              "versionType": "git"
            },
            {
              "lessThan": "e6d3453a002e89537e6136f6c774659b297a549b",
              "status": "affected",
              "version": "38d4f74bc14847491d07bd745dc4a2c274f4987d",
              "versionType": "git"
            },
            {
              "lessThan": "1a7a2f59fb2eb0718a0cff1e5822500cefe50ed9",
              "status": "affected",
              "version": "38d4f74bc14847491d07bd745dc4a2c274f4987d",
              "versionType": "git"
            },
            {
              "lessThan": "ee4cf798202d285dcbe85e4467a094c44f5ed8e6",
              "status": "affected",
              "version": "38d4f74bc14847491d07bd745dc4a2c274f4987d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17-rc1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()\n\nWhen gmin_get_config_var() calls efi.get_variable() and the EFI variable\nis larger than the expected buffer size, two behaviors combine to create\na stack buffer overflow:\n\n1. gmin_get_config_var() does not return the proper error code when\n   efi.get_variable() fails. It returns the stale \u0027ret\u0027 value from\n   earlier operations instead of indicating the EFI failure.\n\n2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates\n   *out_len to the required buffer size but writes no data to the output\n   buffer. However, due to bug #1, gmin_get_var_int() believes the call\n   succeeded.\n\nThe caller gmin_get_var_int() then performs:\n- Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack\n- Calls gmin_get_config_var(dev, is_gmin, var, val, \u0026len) with len=64\n- If EFI variable is \u003e64 bytes, efi.get_variable() sets len=required_size\n- Due to bug #1, thinks call succeeded with len=required_size\n- Executes val[len] = 0, writing past end of 65-byte stack buffer\n\nThis creates a stack buffer overflow when EFI variables are larger than\n64 bytes. Since EFI variables can be controlled by firmware or system\nconfiguration, this could potentially be exploited for code execution.\n\nFix the bug by returning proper error codes from gmin_get_config_var()\nbased on EFI status instead of stale \u0027ret\u0027 value.\n\nThe gmin_get_var_int() function is called during device initialization\nfor camera sensor configuration on Intel Bay Trail and Cherry Trail\nplatforms using the atomisp camera stack."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-19T17:03:07.084Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d672fe065aa00f4d66f42e3c9720f69a3ed43e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6d3453a002e89537e6136f6c774659b297a549b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a7a2f59fb2eb0718a0cff1e5822500cefe50ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6"
        }
      ],
      "title": "staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38585",
    "datePublished": "2025-08-19T17:03:07.084Z",
    "dateReserved": "2025-04-16T04:51:24.026Z",
    "dateUpdated": "2025-08-19T17:03:07.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38585\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-19T17:15:35.877\",\"lastModified\":\"2025-08-20T14:40:17.713\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nstaging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()\\n\\nWhen gmin_get_config_var() calls efi.get_variable() and the EFI variable\\nis larger than the expected buffer size, two behaviors combine to create\\na stack buffer overflow:\\n\\n1. gmin_get_config_var() does not return the proper error code when\\n   efi.get_variable() fails. It returns the stale \u0027ret\u0027 value from\\n   earlier operations instead of indicating the EFI failure.\\n\\n2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates\\n   *out_len to the required buffer size but writes no data to the output\\n   buffer. However, due to bug #1, gmin_get_var_int() believes the call\\n   succeeded.\\n\\nThe caller gmin_get_var_int() then performs:\\n- Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack\\n- Calls gmin_get_config_var(dev, is_gmin, var, val, \u0026len) with len=64\\n- If EFI variable is \u003e64 bytes, efi.get_variable() sets len=required_size\\n- Due to bug #1, thinks call succeeded with len=required_size\\n- Executes val[len] = 0, writing past end of 65-byte stack buffer\\n\\nThis creates a stack buffer overflow when EFI variables are larger than\\n64 bytes. Since EFI variables can be controlled by firmware or system\\nconfiguration, this could potentially be exploited for code execution.\\n\\nFix the bug by returning proper error codes from gmin_get_config_var()\\nbased on EFI status instead of stale \u0027ret\u0027 value.\\n\\nThe gmin_get_var_int() function is called during device initialization\\nfor camera sensor configuration on Intel Bay Trail and Cherry Trail\\nplatforms using the atomisp camera stack.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: staging: media: atomisp: Correcci\u00f3n del desbordamiento del b\u00fafer de pila en gmin_get_var_int() Cuando gmin_get_config_var() llama a efi.get_variable() y la variable EFI es mayor que el tama\u00f1o de b\u00fafer esperado, se combinan dos comportamientos para crear un desbordamiento del b\u00fafer de pila: 1. gmin_get_config_var() no devuelve el c\u00f3digo de error correcto cuando efi.get_variable() falla. Devuelve el valor \u0027ret\u0027 obsoleto de operaciones anteriores en lugar de indicar el fallo de EFI. 2. Cuando efi.get_variable() devuelve EFI_BUFFER_TOO_SMALL, actualiza *out_len al tama\u00f1o de b\u00fafer requerido, pero no escribe datos en el b\u00fafer de salida. Sin embargo, debido al error n.\u00ba 1, gmin_get_var_int() cree que la llamada tuvo \u00e9xito. El llamador gmin_get_var_int() realiza entonces: - Asigna val[CFG_VAR_NAME_MAX + 1] (65 bytes) en la pila - Llama a gmin_get_config_var(dev, is_gmin, var, val, \u0026amp;len) con len=64 - Si la variable EFI es \u0026gt;64 bytes, efi.get_variable() establece len=required_size - Debido al error #1, piensa que la llamada tuvo \u00e9xito con len=required_size - Ejecuta val[len] = 0, escribiendo m\u00e1s all\u00e1 del final del b\u00fafer de pila de 65 bytes Esto crea un desbordamiento del b\u00fafer de pila cuando las variables EFI son mayores de 64 bytes. Dado que las variables EFI pueden ser controladas por el firmware o la configuraci\u00f3n del sistema, esto podr\u00eda ser potencialmente explotado para la ejecuci\u00f3n de c\u00f3digo. Corrija el error devolviendo los c\u00f3digos de error adecuados de gmin_get_config_var() basados en el estado de EFI en lugar del valor \u0027ret\u0027 obsoleto. La funci\u00f3n gmin_get_var_int() se llama durante la inicializaci\u00f3n del dispositivo para la configuraci\u00f3n del sensor de la c\u00e1mara en las plataformas Intel Bay Trail y Cherry Trail utilizando la pila de c\u00e1mara atomisp.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a7a2f59fb2eb0718a0cff1e5822500cefe50ed9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3d672fe065aa00f4d66f42e3c9720f69a3ed43e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e6d3453a002e89537e6136f6c774659b297a549b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.