CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access
In the Linux kernel, the following vulnerability has been resolved:
net/mdiobus: Fix potential out-of-bounds read/write access
When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHYMAXADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write.
Fix that by adding address verification before read/write operation. While this excludes this access from any statistics, it improves security of read/write operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38111?
CVE-2025-38111 has a CVSS score of medium severity due to its potential for out-of-bounds read/write access.
How do I fix CVE-2025-38111?
To fix CVE-2025-38111, update your Linux kernel to the latest stable version where the vulnerability is addressed.
What systems are affected by CVE-2025-38111?
CVE-2025-38111 affects the Linux kernel when using mdio-tools for network interface communication.
What is the impact of CVE-2025-38111?
The impact of CVE-2025-38111 can lead to potential data corruption or denial of service due to improper access checks.
Who is responsible for addressing CVE-2025-38111?
The maintainers of the Linux kernel are responsible for addressing and patching CVE-2025-38111.