{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38422", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.014Z", "datePublished": "2025-07-25T14:16:43.109Z", "dateUpdated": "2026-08-05T12:01:46.048Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:46.048Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices\n\nMaximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb\nand 64 Kb respectively. Adjust max size definitions and return correct\nEEPROM length based on device. Also prevent out-of-bound read/write." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable accessors are reachable only through the `SIOCETHTOOL` ioctl (`ETHTOOL_GEEPROM`/`ETHTOOL_SEEPROM`) issued on a local socket against a local lan743x/PCI11x1x netdev. There is no packet-driven or remote path into `lan743x_hs_otp_*`/`lan743x_hs_eeprom_*`.\nAC:L - The attacker simply supplies the offset and length fields in `struct ethtool_eeprom`; the per-byte loop then walks the device address space deterministically. No race, timing window, or memory-layout condition outside the attacker's control is involved.\nPR:L - The gate is `ns_capable(net->user_ns, CAP_NET_ADMIN)` in `__dev_ethtool()`, a namespace-relative capability that an unprivileged user holds as root of a user namespace owning the netns, and physical NICs are routinely delegated to such containers. This is not real root in the initial namespace.\nUI:N - The attacker drives the whole sequence from their own process with a socket and one ioctl. No action by any other user or victim is required.\nS:U - The unchecked accesses stay within the kernel driver's own authority over the device it already manages; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The missing `offset + length` validation lets `lan743x_hs_otp_read()`/`lan743x_hs_eeprom_read()` read kilobytes of device OTP/EEPROM outside the region the interface is meant to expose, and the ethtool core copies every byte back to userspace via `copy_to_user()`. The disclosure is not bounded to a few bytes.\nI:H - The same unvalidated offset drives `lan743x_hs_otp_write()`/`lan743x_hs_eeprom_write()`, producing out-of-bounds writes into device non-volatile storage; because OTP programming blows fuses irreversibly (and the 10-bit address mask aliases out-of-range offsets onto live rows), device-stored MAC/PHY provisioning is permanently and unauthorizedly altered.\nA:H - Out-of-bounds programming of the OTP/EEPROM leaves the NIC with invalid stored configuration, so the driver fails to bring the interface up and network connectivity is lost. Since blown OTP fuses cannot be cleared, this denial of service is permanent and persists across reboot and driver reload." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/microchip/lan743x_ethtool.c" ], "versions": [ { "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9", "lessThan": "6b4201d74d0a49af2123abf2c9d142e59566714b", "status": "affected", "versionType": "git" }, { "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9", "lessThan": "088279ff18cdc437d6fac5890e0c52c624f78a5b", "status": "affected", "versionType": "git" }, { "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9", "lessThan": "51318d644c993b3f7a60b8616a6a5adc1e967cd2", "status": "affected", "versionType": "git" }, { "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9", "lessThan": "9c41d2a2aa3817946eb613522200cab55513ddaa", "status": "affected", "versionType": "git" }, { "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9", "lessThan": "3b9935586a9b54d2da27901b830d3cf46ad66a1e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/microchip/lan743x_ethtool.c" ], "versions": [ { "version": "4.19", "status": "affected" }, { "version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.142" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.95" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.35" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.15.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/6b4201d74d0a49af2123abf2c9d142e59566714b" }, { "url": "https://git.kernel.org/stable/c/088279ff18cdc437d6fac5890e0c52c624f78a5b" }, { "url": "https://git.kernel.org/stable/c/51318d644c993b3f7a60b8616a6a5adc1e967cd2" }, { "url": "https://git.kernel.org/stable/c/9c41d2a2aa3817946eb613522200cab55513ddaa" }, { "url": "https://git.kernel.org/stable/c/3b9935586a9b54d2da27901b830d3cf46ad66a1e" } ], "title": "net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:37:52.511Z" } } ] } }