CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
In the Linux kernel, the following vulnerability has been resolved:
net: lan743x: fix potential out-of-bounds write in lan743xptpioeventclockget()
Before calling lan743xptpioeventclockget(), the 'channel' value is checked against the maximum value of PCI11X1XPTPIOMAXCHANNELS(8). This seems correct and aligns with the PTP interrupt status register (PTPINTSTS) specifications.
However, lan743xptpioeventclockget() writes to ptp->extts[] with only LAN743XPTPNEXTTS(4) elements, using channel as an index:
lan743xptpioeventclockget(..., u8 channel,...) { ... / Update Local timestamp / extts = &ptp->extts[channel]; extts->ts.tvsec = sec; ... }
To avoid an out-of-bounds write and utilize all the supported GPIO inputs, set LAN743XPTPNEXTTS to 8.
Detected using the static analysis tool - Svace.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Set LAN743X_PTP_N_EXTTS to 8 so lan743x_ptp_io_event_clock_get() allocates entries for all supported GPIO inputs and avoids an out-of-bounds write.
Linux kernel lan743x PTP driver LAN743X_PTP_N_EXTTS = 8
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38183?
CVE-2025-38183 has been classified as a high severity vulnerability due to the potential for out-of-bounds write which can lead to system instability or security breaches.
How do I fix CVE-2025-38183?
To fix CVE-2025-38183, update the Linux kernel to the latest patched version that addresses this vulnerability.
What types of systems are affected by CVE-2025-38183?
CVE-2025-38183 affects systems running vulnerable versions of the Linux kernel that include the lan743x driver.
What is the impact of CVE-2025-38183?
The impact of CVE-2025-38183 could allow an attacker to exploit an out-of-bounds write, potentially leading to arbitrary code execution.
When was CVE-2025-38183 discovered?
CVE-2025-38183 was discovered in the development phases of the Linux kernel and has been resolved in subsequent updates.