CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user()
In the Linux kernel, the following vulnerability has been resolved:
s390/pkey: Prevent overflow in size calculation for memdupuser()
Number of apqn target list entries contained in 'nrapqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdupuser() may overflow.
In this case the actual size of the allocated area and the value describing it won't be in sync leading to various types of unpredictable behaviour later.
Use a proper memduparrayuser() helper which returns an error if an overflow is detected. Note that it is different from when nrapqns is initially zero - that case is considered valid and should be handled in subsequent pkeyhandler implementations.
Found by Linux Verification Center (linuxtesting.org).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the s390/pkey code, replace the memdup_user() allocation and manual size calculation with the memdup_array_user() helper so an overflow in the userspace-controlled nr_apqns array size is detected and returns an error.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38257?
CVE-2025-38257 has a medium severity rating due to the potential for memory overflow affecting system stability.
How do I fix CVE-2025-38257?
To mitigate CVE-2025-38257, update your Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2025-38257?
CVE-2025-38257 affects the Linux kernel, specifically systems using the s390 architecture.
What are the risks of not addressing CVE-2025-38257?
Failing to address CVE-2025-38257 may lead to potential system crashes and unexpected behaviors due to memory overflow.
Is CVE-2025-38257 exploitable?
CVE-2025-38257 is deemed exploitable under certain conditions, particularly where user space can influence kernel memory operations.