CVE-2025-38172: erofs: avoid using multiple devices with different type
In the Linux kernel, the following vulnerability has been resolved:
erofs: avoid using multiple devices with different type
For multiple devices, both primary and extra devices should be the same type. erofsinitdevice has already guaranteed that if the primary is a file-backed device, extra devices should also be regular files.
However, if the primary is a block device while the extra device is a file-backed device, erofsinitdevice will get an ENOTBLK, which is not treated as an error in erofsfcgettree, and that leads to an UAF:
erofsfcgettree gettreebdevflags(erofsfcfillsuper) erofsreadsuperblock erofsinitdevice // sbi->dif0 is not inited yet, // return -ENOTBLK deactivatelockedsuper free(sbi) if (err is -ENOTBLK) sbi->dif0.file = filpopen() // sbi UAF
So if -ENOTBLK is hitted in erofsinitdevice, it means the primary device must be a block device, and the extra device is not a block device. The error can be converted to -EINVAL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38172?
CVE-2025-38172 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38172?
To mitigate CVE-2025-38172, ensure that all devices used with the erofs filesystem are of the same type and apply the latest patches provided for the Linux kernel.
What systems are affected by CVE-2025-38172?
CVE-2025-38172 affects systems using the Linux kernel that utilize the erofs filesystem with multiple devices.
Is CVE-2025-38172 exploitable?
While CVE-2025-38172 may not directly lead to exploitation, it can lead to inconsistencies in device management within the kernel if not addressed.
What are the implications of CVE-2025-38172?
The implications of CVE-2025-38172 include potential data integrity issues when different device types are utilized in the erofs filesystem.