CVE-2025-38152: remoteproc: core: Clear table_sz when rproc_shutdown

Published Apr 18, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

remoteproc: core: Clear tablesz when rprocshutdown

There is case as below could trigger kernel dump: Use U-Boot to start remote processor(rproc) with resource table published to a fixed address by rproc. After Kernel boots up, stop the rproc, load a new firmware which doesn't have resource table ,and start rproc.

When starting rproc with a firmware not have resource table, memcpy(loadedtable, rproc->cachedtable, rproc->tablesz) will trigger dump, because rproc->cachetable is set to NULL during the last stop operation, but rproc->tablesz is still valid.

This issue is found on i.MX8MP and i.MX9.

Dump as below: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000010af63000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 UID: 0 PID: 1060 Comm: sh Not tainted 6.14.0-rc7-next-20250317-dirty #38 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: a0000005 (NzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : pimemcpygeneric+0x110/0x22c lr : rprocstart+0x88/0x1e0 Call trace: pimemcpygeneric+0x110/0x22c (P) rprocboot+0x198/0x57c statestore+0x40/0x104 devattrstore+0x18/0x2c sysfskfwrite+0x7c/0x94 kernfsfopwriteiter+0x120/0x1cc vfswrite+0x240/0x378 ksyswrite+0x70/0x108 arm64syswrite+0x1c/0x28 invokesyscall+0x48/0x10c el0svccommon.constprop.0+0xc0/0xe0 doel0svc+0x1c/0x28 el0svc+0x30/0xcc el0t64synchandler+0x10c/0x138 el0t64sync+0x198/0x19c

Clear rproc->tablesz to address the issue.

Affected Software

7 affected components
Linux Linux kernel
Linux Linux kernel>=5.13<5.15.180
Linux Linux kernel>=5.16<6.1.134
Linux Linux kernel>=6.2<6.6.87
Linux Linux kernel>=6.7<6.12.23
Linux Linux kernel>=6.13<6.13.11
Linux Linux kernel>=6.14<6.14.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Update the Linux kernel remoteproc/rproc code so that it clears rproc->table_sz during rproc_shutdown (“remoteproc: core: Clear table_sz when rproc_shutdown”) and avoids dereferencing a NULL rproc->cache_table when starting rproc with firmware not having a resource table.

    Linux kernel remoteproc (remote processor framework) / rproc firmware with resource table rproc resource table handling = Clear rproc->table_sz when shutting down and prevent cache_table NULL dereference when starting rproc with firmware that lacks a resource table

Event History

Apr 18, 2025
CVE Published
via MITRE·07:01 AM
Data Sourced
via MITRE·07:01 AM
Description
Data Sourced
via NVD·07:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
May 5, 2025
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2025-38152?

CVE-2025-38152 has a moderate severity level as it can lead to a kernel dump under specific conditions.

2

How do I fix CVE-2025-38152?

To fix CVE-2025-38152, ensure that you update the Linux kernel to the latest stable version that includes patches for this vulnerability.

3

What systems are affected by CVE-2025-38152?

CVE-2025-38152 affects systems running the Linux kernel, particularly those using the remote processor feature.

4

What does CVE-2025-38152 entail?

CVE-2025-38152 involves a vulnerability in the Linux kernel's remoteproc component that can trigger kernel dumps when certain conditions are met.

5

Is CVE-2025-38152 exploitable?

CVE-2025-38152 is potentially exploitable if an attacker can control the initialization of a remote processor with specific resource table configurations.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203