CVE-2025-39917 (GCVE-0-2025-39917)
Vulnerability from cvelistv5
Published
2025-10-01 07:44
Modified
2025-10-01 07:44
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt Stanislav reported that in bpf_crypto_crypt() the destination dynptr's size is not validated to be at least as large as the source dynptr's size before calling into the crypto backend with 'len = src_len'. This can result in an OOB write when the destination is smaller than the source. Concretely, in mentioned function, psrc and pdst are both linear buffers fetched from each dynptr: psrc = __bpf_dynptr_data(src, src_len); [...] pdst = __bpf_dynptr_data_rw(dst, dst_len); [...] err = decrypt ? ctx->type->decrypt(ctx->tfm, psrc, pdst, src_len, piv) : ctx->type->encrypt(ctx->tfm, psrc, pdst, src_len, piv); The crypto backend expects pdst to be large enough with a src_len length that can be written. Add an additional src_len > dst_len check and bail out if it's the case. Note that these kfuncs are accessible under root privileges only.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3e1c6f35409f9e447bf37f64840f5b65576bfb78
Version: 3e1c6f35409f9e447bf37f64840f5b65576bfb78
Version: 3e1c6f35409f9e447bf37f64840f5b65576bfb78
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0126358df12d6f476f79251d9c398ac5c1b3062d",
              "status": "affected",
              "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78",
              "versionType": "git"
            },
            {
              "lessThan": "c4be24ef0510c146dca4671effb127e97631534b",
              "status": "affected",
              "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78",
              "versionType": "git"
            },
            {
              "lessThan": "f9bb6ffa7f5ad0f8ee0f53fc4a10655872ee4a14",
              "status": "affected",
              "version": "3e1c6f35409f9e447bf37f64840f5b65576bfb78",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt\n\nStanislav reported that in bpf_crypto_crypt() the destination dynptr\u0027s\nsize is not validated to be at least as large as the source dynptr\u0027s\nsize before calling into the crypto backend with \u0027len = src_len\u0027. This\ncan result in an OOB write when the destination is smaller than the\nsource.\n\nConcretely, in mentioned function, psrc and pdst are both linear\nbuffers fetched from each dynptr:\n\n  psrc = __bpf_dynptr_data(src, src_len);\n  [...]\n  pdst = __bpf_dynptr_data_rw(dst, dst_len);\n  [...]\n  err = decrypt ?\n        ctx-\u003etype-\u003edecrypt(ctx-\u003etfm, psrc, pdst, src_len, piv) :\n        ctx-\u003etype-\u003eencrypt(ctx-\u003etfm, psrc, pdst, src_len, piv);\n\nThe crypto backend expects pdst to be large enough with a src_len length\nthat can be written. Add an additional src_len \u003e dst_len check and bail\nout if it\u0027s the case. Note that these kfuncs are accessible under root\nprivileges only."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-01T07:44:39.423Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0126358df12d6f476f79251d9c398ac5c1b3062d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4be24ef0510c146dca4671effb127e97631534b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9bb6ffa7f5ad0f8ee0f53fc4a10655872ee4a14"
        }
      ],
      "title": "bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39917",
    "datePublished": "2025-10-01T07:44:39.423Z",
    "dateReserved": "2025-04-16T07:20:57.147Z",
    "dateUpdated": "2025-10-01T07:44:39.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39917\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-01T08:15:34.887\",\"lastModified\":\"2025-10-02T19:12:17.160\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt\\n\\nStanislav reported that in bpf_crypto_crypt() the destination dynptr\u0027s\\nsize is not validated to be at least as large as the source dynptr\u0027s\\nsize before calling into the crypto backend with \u0027len = src_len\u0027. This\\ncan result in an OOB write when the destination is smaller than the\\nsource.\\n\\nConcretely, in mentioned function, psrc and pdst are both linear\\nbuffers fetched from each dynptr:\\n\\n  psrc = __bpf_dynptr_data(src, src_len);\\n  [...]\\n  pdst = __bpf_dynptr_data_rw(dst, dst_len);\\n  [...]\\n  err = decrypt ?\\n        ctx-\u003etype-\u003edecrypt(ctx-\u003etfm, psrc, pdst, src_len, piv) :\\n        ctx-\u003etype-\u003eencrypt(ctx-\u003etfm, psrc, pdst, src_len, piv);\\n\\nThe crypto backend expects pdst to be large enough with a src_len length\\nthat can be written. Add an additional src_len \u003e dst_len check and bail\\nout if it\u0027s the case. Note that these kfuncs are accessible under root\\nprivileges only.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0126358df12d6f476f79251d9c398ac5c1b3062d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c4be24ef0510c146dca4671effb127e97631534b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f9bb6ffa7f5ad0f8ee0f53fc4a10655872ee4a14\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.