CVE-2025-38145: soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
In the Linux kernel, the following vulnerability has been resolved:
soc: aspeed: Add NULL check in aspeedlpcenablesnoop()
devmkasprintf() returns NULL when memory allocation fails. Currently, aspeedlpcenablesnoop() does not check for this case, which results in a NULL pointer dereference.
Add NULL check after devmkasprintf() to prevent this issue.
[arj: Fix Fixes: tag to use subject from 3772e5da4454]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Add a NULL check after devm_kasprintf() in aspeed_lpc_enable_snoop() to handle memory-allocation failure and prevent a NULL pointer dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38145?
CVE-2025-38145 has been classified as a medium-severity vulnerability due to potential impacts on system stability.
How do I fix CVE-2025-38145?
To fix CVE-2025-38145, update your Linux kernel to a version that includes the NULL check in aspeed_lpc_enable_snoop().
What is affected by CVE-2025-38145?
CVE-2025-38145 affects the Linux kernel, specifically the aspeed LPC driver functions.
What are the potential impacts of CVE-2025-38145?
Potential impacts of CVE-2025-38145 include system crashes or instability if the NULL pointer dereference occurs.
Is CVE-2025-38145 already resolved?
Yes, CVE-2025-38145 has been resolved in recent updates of the Linux kernel.