CVE-2025-38484: iio: backend: fix out-of-bound write
In the Linux kernel, the following vulnerability has been resolved:
iio: backend: fix out-of-bound write
The buffer is set to 80 character. If a caller write more characters, count is truncated to the max available space in "simplewritetobuffer". But afterwards a string terminator is written to the buffer at offset count without boundary check. The zero termination is written OUT-OF-BOUND.
Add a check that the given buffer is smaller then the buffer to prevent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In simple_write_to_buffer, truncate count to the maximum available buffer space and perform a boundary check before writing the string terminator at offset count.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38484?
The severity of CVE-2025-38484 is categorized as a moderate vulnerability due to the potential for buffer overflows.
How do I fix CVE-2025-38484?
To fix CVE-2025-38484, you should update to the latest version of the Linux kernel where the vulnerability has been addressed.
What are the potential impacts of CVE-2025-38484?
The potential impacts of CVE-2025-38484 include unauthorized access and instability in systems using the affected Linux kernel.
Which versions of Linux Kernel are affected by CVE-2025-38484?
CVE-2025-38484 affects multiple versions of the Linux kernel that have not been updated to address this specific vulnerability.
Is CVE-2025-38484 related to IIO backend functionalities?
Yes, CVE-2025-38484 specifically relates to an out-of-bounds write vulnerability within the IIO backend functions in the Linux kernel.