CVE-2025-21743: usbnet: ipheth: fix possible overflow in DPE length check
In the Linux kernel, the following vulnerability has been resolved:
usbnet: ipheth: fix possible overflow in DPE length check
Originally, it was possible for the DPE length check to overflow if wDatagramIndex + wDatagramLength > U16MAX. This could lead to an OoB read.
Move the wDatagramIndex term to the other side of the inequality.
An existing condition ensures that wDatagramIndex < urb->actuallength.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.78.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21743?
CVE-2025-21743 has a moderate severity level due to the potential for an out-of-bounds read.
How do I fix CVE-2025-21743?
To fix CVE-2025-21743, update to the latest version of the Linux kernel that addresses this vulnerability.
What are the potential impacts of CVE-2025-21743?
The impacts of CVE-2025-21743 include the risk of unauthorized access to memory and possible system instability.
Which systems are affected by CVE-2025-21743?
CVE-2025-21743 affects systems running vulnerable versions of the Linux kernel that utilize the usbnet driver.
Is there a workaround for CVE-2025-21743?
While updating the kernel is the recommended approach, disabling the affected functionality in the usbnet driver may provide temporary protection.