{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38456", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.019Z", "datePublished": "2025-07-25T15:27:35.559Z", "dateUpdated": "2026-08-05T12:02:02.515Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:02.515Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi:msghandler: Fix potential memory corruption in ipmi_create_user()\n\nThe \"intf\" list iterator is an invalid pointer if the correct\n\"intf->intf_num\" is not found. Calling atomic_dec(&intf->nr_users) on\nand invalid pointer will lead to memory corruption.\n\nWe don't really need to call atomic_dec() if we haven't called\natomic_add_return() so update the if (intf->in_shutdown) path as well." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The only attacker-influenced entry point is `open(\"/dev/ipmiN\")` on the IPMI character device, which feeds `iminor(inode)` directly into `ipmi_create_user()`. No remote or adjacent-network data reaches this code path.\nAC:L - Once the attacker can open a device node whose minor has no live interface — a stale/extra node, or the wide window in `ipmi_unregister_smi()` between `list_del()` and `smi_gone()` destroying the node — the out-of-bounds `atomic_dec()` fires deterministically on every call, and can be repeated arbitrarily many times to decrement the target global by a chosen amount.\nPR:L - There is no `capable()`, LSM, or any other privilege check anywhere in `ipmi_open()` → `ipmi_create_user()`; the sole gate is filesystem permissions on `/dev/ipmiN`, which deployments routinely grant to a non-root management group or account for ipmitool/freeipmi-style tooling.\nUI:N - A single `open()` syscall by the attacker triggers the corruption; no victim action, mount, or file-open by another user is required.\nS:U - The corruption is of kernel `.data` and its consequences (privilege escalation, crash) stay within the kernel's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The out-of-bounds write targets kernel globals adjacent to `ipmi_interfaces` — `list_head` and `struct mutex` objects — and corrupting a list pointer's low word yields a traversable wild pointer usable as a kernel memory read primitive, so full confidentiality loss is achievable.\nI:H - This is a controlled out-of-bounds write: a repeatable decrement at a fixed, known kernel-global address, letting the attacker set that word to an arbitrary lower value and thereby corrupt lock ownership or global list pointers into an arbitrary-write primitive and control-flow hijack.\nA:H - Corrupting the module's global mutex owner and list-head state leads to lock-state confusion, deadlock, or an oops/panic on the next traversal, giving a complete denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/char/ipmi/ipmi_msghandler.c" ], "versions": [ { "version": "8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82", "lessThan": "cbc1670297f675854e982d23c8583900ff0cc67a", "status": "affected", "versionType": "git" }, { "version": "8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82", "lessThan": "e2d5c005dfc96fe857676d1d8ac46b29275cb89b", "status": "affected", "versionType": "git" }, { "version": "8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82", "lessThan": "9e0d33e75c1604c3fad5586ad4dfa3b2695a3950", "status": "affected", "versionType": "git" }, { "version": "8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82", "lessThan": "7c1a6ddb99858e7d68961f74ae27caeeeca67b6a", "status": "affected", "versionType": "git" }, { "version": "8e76741c3d8b20dfa2d6c30fa10ff927cfd93d82", "lessThan": "fa332f5dc6fc662ad7d3200048772c96b861cf6b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/char/ipmi/ipmi_msghandler.c" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.146", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.99", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.39", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.7", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.146" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.99" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.15.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cbc1670297f675854e982d23c8583900ff0cc67a" }, { "url": "https://git.kernel.org/stable/c/e2d5c005dfc96fe857676d1d8ac46b29275cb89b" }, { "url": "https://git.kernel.org/stable/c/9e0d33e75c1604c3fad5586ad4dfa3b2695a3950" }, { "url": "https://git.kernel.org/stable/c/7c1a6ddb99858e7d68961f74ae27caeeeca67b6a" }, { "url": "https://git.kernel.org/stable/c/fa332f5dc6fc662ad7d3200048772c96b861cf6b" } ], "title": "ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:38:12.328Z" } } ] } }