CVE-2025-22003 (GCVE-0-2025-22003)
Vulnerability from cvelistv5
Published
2025-04-03 07:19
Modified
2025-05-04 07:27
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix out of bound read in strscpy() source Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()") unintentionally introduced a one byte out of bound read on strscpy()'s source argument (which is kind of ironic knowing that strscpy() is meant to be a more secure alternative :)). Let's consider below buffers: dest[len + 1]; /* will be NUL terminated */ src[len]; /* may not be NUL terminated */ When doing: strncpy(dest, src, len); dest[len] = '\0'; strncpy() will read up to len bytes from src. On the other hand: strscpy(dest, src, len + 1); will read up to len + 1 bytes from src, that is to say, an out of bound read of one byte will occur on src if it is not NUL terminated. Note that the src[len] byte is never copied, but strscpy() still needs to read it to check whether a truncation occurred or not. This exact pattern happened in ucan. The root cause is that the source is not NUL terminated. Instead of doing a copy in a local buffer, directly NUL terminate it as soon as usb_control_msg() returns. With this, the local firmware_str[] variable can be removed. On top of this do a couple refactors: - ucan_ctl_payload->raw is only used for the firmware string, so rename it to ucan_ctl_payload->fw_str and change its type from u8 to char. - ucan_device_request_in() is only used to retrieve the firmware string, so rename it to ucan_get_fw_str() and refactor it to make it directly handle all the string termination logic.
References
Impacted products
Vendor Product Version
Linux Linux Version: 7fdaf8966aae476deafe11f9a0067ff588615444
Version: 7fdaf8966aae476deafe11f9a0067ff588615444
Version: 7fdaf8966aae476deafe11f9a0067ff588615444
Version: 7fdaf8966aae476deafe11f9a0067ff588615444
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/ucan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc29775a8a72d7f3b56cc026796ad99bd65804a7",
              "status": "affected",
              "version": "7fdaf8966aae476deafe11f9a0067ff588615444",
              "versionType": "git"
            },
            {
              "lessThan": "8cec9e314d3360fc1d8346297c41a6ee45cb45a9",
              "status": "affected",
              "version": "7fdaf8966aae476deafe11f9a0067ff588615444",
              "versionType": "git"
            },
            {
              "lessThan": "a4994161a61bc8fd71d105c579d847cefee99262",
              "status": "affected",
              "version": "7fdaf8966aae476deafe11f9a0067ff588615444",
              "versionType": "git"
            },
            {
              "lessThan": "1d22a122ffb116c3cf78053e812b8b21f8852ee9",
              "status": "affected",
              "version": "7fdaf8966aae476deafe11f9a0067ff588615444",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/ucan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.85",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.21",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.9",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ucan: fix out of bound read in strscpy() source\n\nCommit 7fdaf8966aae (\"can: ucan: use strscpy() to instead of strncpy()\")\nunintentionally introduced a one byte out of bound read on strscpy()\u0027s\nsource argument (which is kind of ironic knowing that strscpy() is meant\nto be a more secure alternative :)).\n\nLet\u0027s consider below buffers:\n\n  dest[len + 1]; /* will be NUL terminated */\n  src[len]; /* may not be NUL terminated */\n\nWhen doing:\n\n  strncpy(dest, src, len);\n  dest[len] = \u0027\\0\u0027;\n\nstrncpy() will read up to len bytes from src.\n\nOn the other hand:\n\n  strscpy(dest, src, len + 1);\n\nwill read up to len + 1 bytes from src, that is to say, an out of bound\nread of one byte will occur on src if it is not NUL terminated. Note\nthat the src[len] byte is never copied, but strscpy() still needs to\nread it to check whether a truncation occurred or not.\n\nThis exact pattern happened in ucan.\n\nThe root cause is that the source is not NUL terminated. Instead of\ndoing a copy in a local buffer, directly NUL terminate it as soon as\nusb_control_msg() returns. With this, the local firmware_str[] variable\ncan be removed.\n\nOn top of this do a couple refactors:\n\n  - ucan_ctl_payload-\u003eraw is only used for the firmware string, so\n    rename it to ucan_ctl_payload-\u003efw_str and change its type from u8 to\n    char.\n\n  - ucan_device_request_in() is only used to retrieve the firmware\n    string, so rename it to ucan_get_fw_str() and refactor it to make it\n    directly handle all the string termination logic."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:27:14.151Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc29775a8a72d7f3b56cc026796ad99bd65804a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cec9e314d3360fc1d8346297c41a6ee45cb45a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4994161a61bc8fd71d105c579d847cefee99262"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d22a122ffb116c3cf78053e812b8b21f8852ee9"
        }
      ],
      "title": "can: ucan: fix out of bound read in strscpy() source",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22003",
    "datePublished": "2025-04-03T07:19:05.403Z",
    "dateReserved": "2024-12-29T08:45:45.802Z",
    "dateUpdated": "2025-05-04T07:27:14.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22003\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-03T08:15:15.840\",\"lastModified\":\"2025-04-10T16:13:15.503\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: ucan: fix out of bound read in strscpy() source\\n\\nCommit 7fdaf8966aae (\\\"can: ucan: use strscpy() to instead of strncpy()\\\")\\nunintentionally introduced a one byte out of bound read on strscpy()\u0027s\\nsource argument (which is kind of ironic knowing that strscpy() is meant\\nto be a more secure alternative :)).\\n\\nLet\u0027s consider below buffers:\\n\\n  dest[len + 1]; /* will be NUL terminated */\\n  src[len]; /* may not be NUL terminated */\\n\\nWhen doing:\\n\\n  strncpy(dest, src, len);\\n  dest[len] = \u0027\\\\0\u0027;\\n\\nstrncpy() will read up to len bytes from src.\\n\\nOn the other hand:\\n\\n  strscpy(dest, src, len + 1);\\n\\nwill read up to len + 1 bytes from src, that is to say, an out of bound\\nread of one byte will occur on src if it is not NUL terminated. Note\\nthat the src[len] byte is never copied, but strscpy() still needs to\\nread it to check whether a truncation occurred or not.\\n\\nThis exact pattern happened in ucan.\\n\\nThe root cause is that the source is not NUL terminated. Instead of\\ndoing a copy in a local buffer, directly NUL terminate it as soon as\\nusb_control_msg() returns. With this, the local firmware_str[] variable\\ncan be removed.\\n\\nOn top of this do a couple refactors:\\n\\n  - ucan_ctl_payload-\u003eraw is only used for the firmware string, so\\n    rename it to ucan_ctl_payload-\u003efw_str and change its type from u8 to\\n    char.\\n\\n  - ucan_device_request_in() is only used to retrieve the firmware\\n    string, so rename it to ucan_get_fw_str() and refactor it to make it\\n    directly handle all the string termination logic.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: ucan: fix out of bound read in strscpy() source Commit 7fdaf8966aae (\\\"can: ucan: use strscpy() to instead of strncpy()\\\") introdujo involuntariamente una lectura fuera de los l\u00edmite de un byte en el argumento source de strscpy() (lo cual es un poco ir\u00f3nico sabiendo que strscpy() est\u00e1 destinado a ser una alternativa m\u00e1s segura :)). Consideremos los siguientes b\u00faferes: dest[len + 1]; /* terminar\u00e1 en NUL */ src[len]; /* puede que no termine en NUL */ Al hacer: strncpy(dest, src, len); dest[len] = \u0027\\\\0\u0027; strncpy() leer\u00e1 hasta len bytes desde src. Por otro lado: strscpy(dest, src, len + 1); Leer\u00e1 hasta len + 1 bytes de src; es decir, se producir\u00e1 una lectura fuera de los l\u00edmites de un byte en src si no termina en NUL. Tenga en cuenta que el byte src[len] nunca se copia, pero strscpy() a\u00fan necesita leerlo para verificar si se produjo un truncamiento. Este mismo patr\u00f3n ocurri\u00f3 en ucan. La causa ra\u00edz es que el origen no termina en NUL. En lugar de hacer una copia en un b\u00fafer local, termine directamente en NUL tan pronto como usb_control_msg() regrese. Con esto, se puede eliminar la variable local firmware_str[]. Adem\u00e1s, realice un par de refactorizaciones: - ucan_ctl_payload-\u0026gt;raw solo se usa para la cadena de firmware, as\u00ed que ren\u00f3mbrelo a ucan_ctl_payload-\u0026gt;fw_str y cambie su tipo de u8 a char. - ucan_device_request_in() solo se utiliza para recuperar la cadena de firmware, as\u00ed que c\u00e1mbiele el nombre a ucan_get_fw_str() y refactor\u00edcelo para que gestione directamente toda la l\u00f3gica de terminaci\u00f3n de la cadena.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.85\",\"matchCriteriaId\":\"BCB56F36-C998-496A-A2E4-D9E0BB3A5BFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.21\",\"matchCriteriaId\":\"3B63C450-D73B-4A53-9861-98E25C16E842\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.9\",\"matchCriteriaId\":\"FAECBE4D-58CF-4836-BBAB-5E28B800A778\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1759FFB7-531C-41B1-9AE1-FD3D80E0D920\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD948719-8628-4421-A340-1066314BBD4A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1d22a122ffb116c3cf78053e812b8b21f8852ee9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8cec9e314d3360fc1d8346297c41a6ee45cb45a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a4994161a61bc8fd71d105c579d847cefee99262\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cc29775a8a72d7f3b56cc026796ad99bd65804a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.