- Vulnerability/
- CVE-2025-37832
CVE-2025-37832: cpufreq: sun50i: prevent out-of-bounds access
First published: Thu May 08 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: cpufreq: sun50i: prevent out-of-bounds access A KASAN enabled kernel reports an out-of-bounds access when handling the nvmem cell in the sun50i cpufreq driver: ================================================================== BUG: KASAN: slab-out-of-bounds in sun50i_cpufreq_nvmem_probe+0x180/0x3d4 Read of size 4 at addr ffff000006bf31e0 by task kworker/u16:1/38 This is because the DT specifies the nvmem cell as covering only two bytes, but we use a u32 pointer to read the value. DTs for other SoCs indeed specify 4 bytes, so we cannot just shorten the variable to a u16. Fortunately nvmem_cell_read() allows to return the length of the nvmem cell, in bytes, so we can use that information to only access the valid portion of the data. To cover multiple cell sizes, use memcpy() to copy the information into a zeroed u32 buffer, then also make sure we always read the data in little endian fashion, as this is how the data is stored in the SID efuses.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-37832?
CVE-2025-37832 has been categorized as a medium severity vulnerability due to the potential for out-of-bounds access in the sun50i cpufreq driver.
How do I fix CVE-2025-37832?
To fix CVE-2025-37832, users should update their Linux kernel to the latest version where this vulnerability has been addressed.
What is the impact of CVE-2025-37832?
The impact of CVE-2025-37832 is the possibility of system instability or compromised security due to out-of-bounds memory access.
Who is affected by CVE-2025-37832?
CVE-2025-37832 affects users running affected versions of the Linux kernel that utilize the sun50i cpufreq driver.
Is there a workaround for CVE-2025-37832?
Currently, there are no known workarounds for CVE-2025-37832 other than applying the appropriate kernel update.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/author
- agent/source
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/linux kernel