CVE-2025-71197: w1: therm: Fix off-by-one buffer overflow in alarms_store
In the Linux kernel, the following vulnerability has been resolved:
w1: therm: Fix off-by-one buffer overflow in alarmsstore
The sysfs buffer passed to alarmsstore() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'.
Fix this by parsing the 'buf' parameter directly using simplestrtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In w1 therm alarms_store, parse the buf parameter directly with simple_strtoll() without allocating intermediate memory or copying the string.
Event History
Frequently Asked Questions
What access is needed to trigger the flaw?
An attacker needs to provide input to the sysfs interface handled by alarms_store(). The provided information does not specify the required filesystem permissions or whether unprivileged users can write to that interface.
How can I determine whether a kernel source tree contains the fix?
Check the alarms_store() implementation in the w1 therm driver. A vulnerable implementation allocates size bytes and uses strcpy() on the sysfs buffer; the fixed implementation parses buf directly with simple_strtoll() and does not create an intermediate copied string.
What code change addresses the overflow?
The fix removes the allocation and strcpy() operation that copies the NUL terminator one byte beyond a size-byte allocation. It instead parses the supplied buffer directly using simple_strtoll().