CVE-2025-38574: pptp: ensure minimal skb length in pptp_xmit()
In the Linux kernel, the following vulnerability has been resolved:
pptp: ensure minimal skb length in pptpxmit()
Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on pppsynctxmung") fixed pppsynctxmunge()
We need a similar fix in pptpxmit(), otherwise we might read uninit data as reported by syzbot.
BUG: KMSAN: uninit-value in pptpxmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pptpxmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pppchannelbridgeinput drivers/net/ppp/pppgeneric.c:2290 [inline] pppinput+0x1d6/0xe60 drivers/net/ppp/pppgeneric.c:2314 pppoercvcore+0x1e8/0x760 drivers/net/ppp/pppoe.c:379 skbacklogrcv+0x142/0x420 include/net/sock.h:1148 releasesock+0x1d3/0x330 net/core/sock.c:3213 releasesock+0x6b/0x270 net/core/sock.c:3767 pppoesendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904 socksendmsgnosec net/socket.c:712 [inline] socksendmsg+0x330/0x3d0 net/socket.c:727 syssendmsg+0x893/0xd80 net/socket.c:2566 syssendmsg+0x271/0x3b0 net/socket.c:2620 syssendmmsg+0x2d9/0x7c0 net/socket.c:2709
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch aabc6596ffb3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38574?
CVE-2025-38574 is considered a medium severity vulnerability due to the potential for data corruption.
How do I fix CVE-2025-38574?
To fix CVE-2025-38574, update the Linux kernel to the latest version that includes the security patch.
What impact does CVE-2025-38574 have on affected systems?
CVE-2025-38574 may lead to instability and data integrity issues in systems utilizing the PPTP protocol.
Is CVE-2025-38574 exploitable remotely?
CVE-2025-38574 can potentially be exploited remotely if the PPTP service is exposed to untrusted networks.
When was CVE-2025-38574 first reported?
CVE-2025-38574 was first reported as resolved with the commit aabc6596ffb3 in the Linux kernel.