CVE-2025-38478: comedi: Fix initialization of data for instructions that write to subdevice
In the Linux kernel, the following vulnerability has been resolved:
comedi: Fix initialization of data for instructions that write to subdevice
Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first insn->n elements in some cases. The doinsnioctl() and doinsnlistioctl() functions allocate at least MINSAMPLES (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first insn->n data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first MINSAMPLES elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For doinsnlistioctl(), the same data buffer elements are used for handling a list of instructions, so ensure the first MINSAMPLES elements are initialized for each instruction that writes to the subdevice.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
For Comedi instructions that write to a subdevice, initialize the first MIN_SAMPLES (16) data elements before invoking the instruction handler, filling elements not copied from user space with 0. In do_insnlist_ioctl(), perform this initialization for each instruction that writes to the subdevice.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38478?
CVE-2025-38478 has a medium severity rating due to potential data corruption issues.
How do I fix CVE-2025-38478?
To fix CVE-2025-38478, users should update their Linux kernel to the latest stable version where the vulnerability has been resolved.
Who is affected by CVE-2025-38478?
CVE-2025-38478 affects users of certain versions of the Linux kernel that utilize Comedi subdevice instruction handlers.
What types of attacks can exploit CVE-2025-38478?
Exploiting CVE-2025-38478 could allow an attacker to potentially corrupt data managed by specific Comedi subdevice instruction handlers.
Is CVE-2025-38478 still an active threat?
As of the latest updates, CVE-2025-38478 should no longer pose an active threat if systems are patched accordingly.