CVE-2025-68352: spi: ch341: fix out-of-bounds memory access in ch341_transfer_one
In the Linux kernel, the following vulnerability has been resolved:
spi: ch341: fix out-of-bounds memory access in ch341transferone
Discovered by Atuin - Automated Vulnerability Discovery Engine.
The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header.
When copying data from 'trans->txbuf' to 'ch341->txbuf + 1', using 'len' as the length is incorrect because:
1. It causes an out-of-bounds read from 'trans->txbuf' (which has size 'trans->len', i.e., 'len - 1' in this context). 2. It can cause an out-of-bounds write to 'ch341->txbuf' if 'len' is CH341PACKETLENGTH (32). Writing 32 bytes to ch341->txbuf + 1 overflows the buffer.
Fix this by copying 'len - 1' bytes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68352?
CVE-2025-68352 is classified as a medium severity vulnerability due to the potential for out-of-bounds memory access.
How do I fix CVE-2025-68352?
To fix CVE-2025-68352, update the Linux kernel to the latest stable version where this vulnerability has been resolved.
What components are affected by CVE-2025-68352?
CVE-2025-68352 affects the SPI (Serial Peripheral Interface) subsystem in the Linux kernel related to the ch341 driver.
What type of vulnerability is CVE-2025-68352?
CVE-2025-68352 is an out-of-bounds memory access vulnerability which could lead to undefined behavior or potential data corruption.
Who discovered CVE-2025-68352?
CVE-2025-68352 was discovered by Atuin, the Automated Vulnerability Discovery Engine.