CVE-2025-38715: hfs: fix slab-out-of-bounds in hfs_bnode_read()
In the Linux kernel, the following vulnerability has been resolved:
hfs: fix slab-out-of-bounds in hfsbnoderead()
This patch introduces isbnodeoffsetvalid() method that checks the requested offset value. Also, it introduces checkandcorrectrequestedlength() method that checks and correct the requested length (if it is necessary). These methods are used in hfsbnoderead(), hfsbnodewrite(), hfsbnodeclear(), hfsbnodecopy(), and hfsbnodemove() with the goal to prevent the access out of allocated memory and triggering the crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38715?
CVE-2025-38715 is classified as a high-severity vulnerability due to potential exploitation leading to arbitrary memory access.
How do I fix CVE-2025-38715?
To fix CVE-2025-38715, update your Linux kernel to the latest version where this vulnerability has been addressed.
What systems are affected by CVE-2025-38715?
CVE-2025-38715 affects various versions of the Linux kernel that implement the HFS filesystem.
Is CVE-2025-38715 exploitable remotely?
CVE-2025-38715 could potentially be exploited remotely if the affected HFS filesystem is accessible over the network.
What are the potential impacts of CVE-2025-38715?
The impacts of CVE-2025-38715 include potential denial of service and arbitrary code execution due to memory corruption.