CVE-2025-39787 (GCVE-0-2025-39787)
Vulnerability from cvelistv5
Published
2025-09-11 16:56
Modified
2025-09-11 16:56
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0d59ce2bfc3bb13abe6240335a1bf7b96536d022
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1096eb63ecfc8df90b70cd068e6de0c2ff204dfd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/43d26997d88c4056fce0324e72f62556bc7e8e8d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/81278be4eb5f08ba2c68c3055893e61cc03727fe
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/87bfabb3b2f46827639173f143aa43f7cfc0a7e6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/981c845f29838e468a9bfa87f784307193a31297
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9f9967fed9d066ed3dae9372b45ffa4f6fccfeef
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e1720eb32acf411c328af6a8c8f556c94535808e
Impacted products
Vendor Product Version
Linux Linux Version: 2aad40d911eeb7dcac91c669f2762a28134f0eb1
Version: 2aad40d911eeb7dcac91c669f2762a28134f0eb1
Version: 2aad40d911eeb7dcac91c669f2762a28134f0eb1
Version: 2aad40d911eeb7dcac91c669f2762a28134f0eb1
Version: 2aad40d911eeb7dcac91c669f2762a28134f0eb1
Version: 2aad40d911eeb7dcac91c669f2762a28134f0eb1
Version: 2aad40d911eeb7dcac91c669f2762a28134f0eb1
Version: 2aad40d911eeb7dcac91c669f2762a28134f0eb1
 Create a notification for this product.
   Linux Linux Version: 4.11
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/soc/qcom/mdt_loader.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1096eb63ecfc8df90b70cd068e6de0c2ff204dfd",
              "status": "affected",
              "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
              "versionType": "git"
            },
            {
              "lessThan": "e1720eb32acf411c328af6a8c8f556c94535808e",
              "status": "affected",
              "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
              "versionType": "git"
            },
            {
              "lessThan": "0d59ce2bfc3bb13abe6240335a1bf7b96536d022",
              "status": "affected",
              "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
              "versionType": "git"
            },
            {
              "lessThan": "43d26997d88c4056fce0324e72f62556bc7e8e8d",
              "status": "affected",
              "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
              "versionType": "git"
            },
            {
              "lessThan": "981c845f29838e468a9bfa87f784307193a31297",
              "status": "affected",
              "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
              "versionType": "git"
            },
            {
              "lessThan": "87bfabb3b2f46827639173f143aa43f7cfc0a7e6",
              "status": "affected",
              "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
              "versionType": "git"
            },
            {
              "lessThan": "81278be4eb5f08ba2c68c3055893e61cc03727fe",
              "status": "affected",
              "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
              "versionType": "git"
            },
            {
              "lessThan": "9f9967fed9d066ed3dae9372b45ffa4f6fccfeef",
              "status": "affected",
              "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/soc/qcom/mdt_loader.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17-rc1",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: mdt_loader: Ensure we don\u0027t read past the ELF header\n\nWhen the MDT loader is used in remoteproc, the ELF header is sanitized\nbeforehand, but that\u0027s not necessary the case for other clients.\n\nValidate the size of the firmware buffer to ensure that we don\u0027t read\npast the end as we iterate over the header. e_phentsize and e_shentsize\nare validated as well, to ensure that the assumptions about step size in\nthe traversal are valid."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-11T16:56:36.426Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1096eb63ecfc8df90b70cd068e6de0c2ff204dfd"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1720eb32acf411c328af6a8c8f556c94535808e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d59ce2bfc3bb13abe6240335a1bf7b96536d022"
        },
        {
          "url": "https://git.kernel.org/stable/c/43d26997d88c4056fce0324e72f62556bc7e8e8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/981c845f29838e468a9bfa87f784307193a31297"
        },
        {
          "url": "https://git.kernel.org/stable/c/87bfabb3b2f46827639173f143aa43f7cfc0a7e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/81278be4eb5f08ba2c68c3055893e61cc03727fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f9967fed9d066ed3dae9372b45ffa4f6fccfeef"
        }
      ],
      "title": "soc: qcom: mdt_loader: Ensure we don\u0027t read past the ELF header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39787",
    "datePublished": "2025-09-11T16:56:36.426Z",
    "dateReserved": "2025-04-16T07:20:57.131Z",
    "dateUpdated": "2025-09-11T16:56:36.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39787\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-11T17:15:44.907\",\"lastModified\":\"2025-09-15T15:22:38.297\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsoc: qcom: mdt_loader: Ensure we don\u0027t read past the ELF header\\n\\nWhen the MDT loader is used in remoteproc, the ELF header is sanitized\\nbeforehand, but that\u0027s not necessary the case for other clients.\\n\\nValidate the size of the firmware buffer to ensure that we don\u0027t read\\npast the end as we iterate over the header. e_phentsize and e_shentsize\\nare validated as well, to ensure that the assumptions about step size in\\nthe traversal are valid.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d59ce2bfc3bb13abe6240335a1bf7b96536d022\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1096eb63ecfc8df90b70cd068e6de0c2ff204dfd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/43d26997d88c4056fce0324e72f62556bc7e8e8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/81278be4eb5f08ba2c68c3055893e61cc03727fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/87bfabb3b2f46827639173f143aa43f7cfc0a7e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/981c845f29838e468a9bfa87f784307193a31297\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9f9967fed9d066ed3dae9372b45ffa4f6fccfeef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e1720eb32acf411c328af6a8c8f556c94535808e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.