CVE-2025-22044: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
In the Linux kernel, the following vulnerability has been resolved:
acpi: nfit: fix narrowing conversion in acpinfitctl
Syzkaller has reported a warning in tonfitbusuuid(): "only secondary bus families can be translated". This warning is emited if the argument is equal to NVDIMMBUSFAMILYNFIT == 0. Function acpinfitctl() first verifies that a user-provided value callpkg->ndfamily of type u64 is not equal to 0. Then the value is converted to int, and only after that is compared to NVDIMMBUSFAMILYMAX. This can lead to passing an invalid argument to acpinfitctl(), if callpkg->ndfamily is non-zero, while the lower 32 bits are zero.
Furthermore, it is best to return EINVAL immediately upon seeing the invalid user input. The WARNING is insufficient to prevent further undefined behavior based on other invalid user input.
All checks of the input value should be applied to the original variable callpkg->ndfamily.
[iweiny: update commit message]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In acpi_nfit_ctl(), validate the original u64 input call_pkg->nd_family before narrowing it to int: reject values equal to 0 and values exceeding NVDIMM_BUS_FAMILY_MAX, returning EINVAL immediately for invalid input.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What malformed input triggers the vulnerable path?
The affected path can be reached when the user-provided 64-bit nd_family value is nonzero but has its lower 32 bits set to zero. Conversion to int then narrows the value before validation, allowing an invalid bus-family argument to proceed.
What is the potential impact?
The issue is rated high severity with a CVSS 3.1 score of 7.1. The vector indicates high confidentiality and availability impact, with no integrity impact.
How does the fix change handling of invalid input?
The fix applies validation checks to the original 64-bit nd_family value rather than the narrowed int value. Invalid input is rejected immediately with EINVAL instead of relying on a warning and continuing into potentially undefined behavior.