Vulnerability-Lookup

GHSA-RC74-9J9P-C3XP

Vulnerability from github – Published: 2025-05-08 09:30 – Updated: 2025-11-13 00:30

Details

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Fix invalid pointer dereference in Etron workaround

This check is performed before prepare_transfer() and prepare_ring(), so enqueue can already point at the final link TRB of a segment. And indeed it will, some 0.4% of times this code is called.

Then enqueue + 1 is an invalid pointer. It will crash the kernel right away or load some junk which may look like a link TRB and cause the real link TRB to be replaced with a NOOP. This wouldn't end well.

Use a functionally equivalent test which doesn't dereference the pointer and always gives correct result.

Something has crashed my machine twice in recent days while playing with an Etron HC, and a control transfer stress test ran for confirmation has just crashed it again. The same test passes with this patch applied.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-37813"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-08T07:15:52Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix invalid pointer dereference in Etron workaround\n\nThis check is performed before prepare_transfer() and prepare_ring(), so\nenqueue can already point at the final link TRB of a segment. And indeed\nit will, some 0.4% of times this code is called.\n\nThen enqueue + 1 is an invalid pointer. It will crash the kernel right\naway or load some junk which may look like a link TRB and cause the real\nlink TRB to be replaced with a NOOP. This wouldn\u0027t end well.\n\nUse a functionally equivalent test which doesn\u0027t dereference the pointer\nand always gives correct result.\n\nSomething has crashed my machine twice in recent days while playing with\nan Etron HC, and a control transfer stress test ran for confirmation has\njust crashed it again. The same test passes with this patch applied.",
  "id": "GHSA-rc74-9j9p-c3xp",
  "modified": "2025-11-13T00:30:16Z",
  "published": "2025-05-08T09:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37813"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0624e29c595b05e7a0e6d1c368f0a05799928e30"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/142273a49f2c315eabdbdf5a71c15e479b75ca91"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1ea050da5562af9b930d17cbbe9632d30f5df43a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bce3055b08e303e28a8751f6073066f5c33a0744"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-37813 (GCVE-0-2025-37813)

Vulnerability from cvelistv5 – Published: 2025-05-08 06:26 – Updated: 2026-08-05 11:57

Title

usb: xhci: Fix invalid pointer dereference in Etron workaround

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix invalid pointer dereference in Etron workaround This check is performed before prepare_transfer() and prepare_ring(), so enqueue can already point at the final link TRB of a segment. And indeed it will, some 0.4% of times this code is called. Then enqueue + 1 is an invalid pointer. It will crash the kernel right away or load some junk which may look like a link TRB and cause the real link TRB to be replaced with a NOOP. This wouldn't end well. Use a functionally equivalent test which doesn't dereference the pointer and always gives correct result. Something has crashed my machine twice in recent days while playing with an Etron HC, and a control transfer stress test ran for confirmation has just crashed it again. The same test passes with this patch applied.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/142273a49f2c315ea…
https://git.kernel.org/stable/c/bce3055b08e303e28…
https://git.kernel.org/stable/c/0624e29c595b05e7a…
https://git.kernel.org/stable/c/1ea050da5562af9b9…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fbc0a0c7718a6cb1dc5e0811a4f88a2b1deedfa1 , < 142273a49f2c315eabdbdf5a71c15e479b75ca91 (git) Affected: 9258c9ed32294ce3a4b58c9d92fc49ba030d35c9 , < bce3055b08e303e28a8751f6073066f5c33a0744 (git) Affected: 5e1c67abc9301d05130b7e267c204e7005503b33 , < 0624e29c595b05e7a0e6d1c368f0a05799928e30 (git) Affected: 5e1c67abc9301d05130b7e267c204e7005503b33 , < 1ea050da5562af9b930d17cbbe9632d30f5df43a (git) Affected: 4725344ca645a98a9d8e45e25b01a2244de5b8aa (git) Affected: 6.6.66 , < 6.6.89 (semver) Affected: 6.12.2 , < 6.12.26 (semver) Affected: 6.11.11 , < 6.12 (semver)
Linux	Linux	Affected: 6.13 Unaffected: 0 , < 6.13 (semver) Unaffected: 6.6.89 , ≤ 6.6.* (semver) Unaffected: 6.12.26 , ≤ 6.12.* (semver) Unaffected: 6.14.5 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "142273a49f2c315eabdbdf5a71c15e479b75ca91",
              "status": "affected",
              "version": "fbc0a0c7718a6cb1dc5e0811a4f88a2b1deedfa1",
              "versionType": "git"
            },
            {
              "lessThan": "bce3055b08e303e28a8751f6073066f5c33a0744",
              "status": "affected",
              "version": "9258c9ed32294ce3a4b58c9d92fc49ba030d35c9",
              "versionType": "git"
            },
            {
              "lessThan": "0624e29c595b05e7a0e6d1c368f0a05799928e30",
              "status": "affected",
              "version": "5e1c67abc9301d05130b7e267c204e7005503b33",
              "versionType": "git"
            },
            {
              "lessThan": "1ea050da5562af9b930d17cbbe9632d30f5df43a",
              "status": "affected",
              "version": "5e1c67abc9301d05130b7e267c204e7005503b33",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4725344ca645a98a9d8e45e25b01a2244de5b8aa",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.89",
              "status": "affected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.26",
              "status": "affected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.89",
                  "versionStartIncluding": "6.6.66",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "6.12.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.5",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix invalid pointer dereference in Etron workaround\n\nThis check is performed before prepare_transfer() and prepare_ring(), so\nenqueue can already point at the final link TRB of a segment. And indeed\nit will, some 0.4% of times this code is called.\n\nThen enqueue + 1 is an invalid pointer. It will crash the kernel right\naway or load some junk which may look like a link TRB and cause the real\nlink TRB to be replaced with a NOOP. This wouldn\u0027t end well.\n\nUse a functionally equivalent test which doesn\u0027t dereference the pointer\nand always gives correct result.\n\nSomething has crashed my machine twice in recent days while playing with\nan Etron HC, and a control transfer stress test ran for confirmation has\njust crashed it again. The same test passes with this patch applied."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered whenever a control transfer is queued on a SuperSpeed device\u0027s ep0, which an unprivileged local process can drive directly via usbfs ioctls (USBDEVFS_CONTROL/USBDEVFS_SUBMITURB), hidraw feature reports, or ALSA/UVC control APIs on an already-attached device. No network or physical access is needed once any USB3 device is present on the Etron host.\nAC:L - Within the affected configuration the attacker fully controls the trigger \u2014 the enqueue pointer lands on the segment\u0027s final Link TRB on roughly 0.4% of calls, so a short loop of control transfers hits it deterministically in well under a second, exactly as the author\u0027s stress test demonstrated. No memory layout or timing condition outside the attacker\u0027s influence is required.\nPR:L - A basic unprivileged local account suffices, since desktop/kiosk systems grant the seat\u0027s logged-in user access to USB device nodes (usbfs, hidraw, ALSA controls) through udev uaccess rules, and any of those interfaces emit ep0 control transfers. No CAP_SYS_ADMIN or root is required to reach xhci_queue_ctrl_tx().\nUI:N - The attacker issues the control transfers from their own process; no victim action, no mount, and no file-open by another user is involved. Enumeration-driven variants are likewise self-initiated.\nS:U - The out-of-bounds read and the subsequent ring corruption both occur within kernel memory managed by the same security authority; the impact does not cross a VM, IOMMU, or sandbox boundary in the CVSS sense.\nC:H - The out-of-bounds read pulls in contents of an unrelated page adjacent to the DMA segment, and the resulting Link-TRB destruction makes the host controller execute arbitrary post-segment memory as TRBs whose 64-bit buffer pointers can source DMA reads from arbitrary kernel memory, with the data delivered back to userspace through URB completion.\nI:H - The driver overwrites the live Link TRB with a No-Op, corrupting the transfer ring, after which the xHC fetches junk TRBs from outside the ring and can perform DMA writes of device-supplied data to attacker-influenceable addresses \u2014 an arbitrary kernel memory write primitive suitable for control-flow hijacking.\nA:H - The commit states the invalid dereference \"will crash the kernel right away\" on the OOB access; failing that, the corrupted ring wedges the endpoint permanently (\"Tried to move enqueue past ring segment\") and drives the controller off the end of the segment, and the author reproduced machine crashes three times."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:42.473Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/142273a49f2c315eabdbdf5a71c15e479b75ca91"
        },
        {
          "url": "https://git.kernel.org/stable/c/bce3055b08e303e28a8751f6073066f5c33a0744"
        },
        {
          "url": "https://git.kernel.org/stable/c/0624e29c595b05e7a0e6d1c368f0a05799928e30"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ea050da5562af9b930d17cbbe9632d30f5df43a"
        }
      ],
      "title": "usb: xhci: Fix invalid pointer dereference in Etron workaround",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37813",
    "datePublished": "2025-05-08T06:26:10.000Z",
    "dateReserved": "2025-04-16T04:51:23.946Z",
    "dateUpdated": "2026-08-05T11:57:42.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.