CVE-2025-37911 (GCVE-0-2025-37911)
Vulnerability from cvelistv5
Published
2025-05-20 15:21
Modified
2025-05-26 05:23
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This happens when copying the coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command. The info->dest_buf buffer is allocated based on the number of coredump segments returned by the FW. The segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver then copies this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf length and cause the above BUG condition. Fix it by capping the copy length to not exceed the length of info->dest_buf. The extra DMA data contains no useful information. This code path is shared for the HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different for these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands.
References
Impacted products
Vendor Product Version
Linux Linux Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: c74751f4c39232c31214ec6a3bc1c7e62f5c728b
Version: 4bf973a1f84aefb64750bdb3afe72d54de3199d7
Version: a76837dd731b68cc3b5690470bc9efa2a8e3801a
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69b10dd23ab826d0c7f2d9ab311842251978d0c1",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "43292b83424158fa6ec458799f3cb9c54d18c484",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "4d69864915a3a052538e4ba76cd6fd77cfc64ebe",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "44807af79efd0d78fa36383dd865ddfe7992c0a6",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "44d81a9ebf0cad92512e0ffdf7412bfe20db66ec",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "6b87bd94f34370bbf1dfa59352bed8efab5bf419",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bf973a1f84aefb64750bdb3afe72d54de3199d7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a76837dd731b68cc3b5690470bc9efa2a8e3801a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.182",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.138",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\n\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\nmemory corruption:\n\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nethtool_get_dump_data+0xdc/0x1a0\n__dev_ethtool+0xa1e/0x1af0\ndev_ethtool+0xa8/0x170\ndev_ioctl+0x1b5/0x580\nsock_do_ioctl+0xab/0xf0\nsock_ioctl+0x1ce/0x2e0\n__x64_sys_ioctl+0x87/0xc0\ndo_syscall_64+0x5c/0xf0\nentry_SYSCALL_64_after_hwframe+0x78/0x80\n\n...\n\nThis happens when copying the coredump segment list in\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\nThe info-\u003edest_buf buffer is allocated based on the number of coredump\nsegments returned by the FW.  The segment list is then DMA\u0027ed by\nthe FW and the length of the DMA is returned by FW.  The driver then\ncopies this DMA\u0027ed segment list to info-\u003edest_buf.\n\nIn some cases, this DMA length may exceed the info-\u003edest_buf length\nand cause the above BUG condition.  Fix it by capping the copy\nlength to not exceed the length of info-\u003edest_buf.  The extra\nDMA data contains no useful information.\n\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\nHWRM_DBG_COREDUMP_RETRIEVE FW commands.  The buffering is different\nfor these 2 FW commands.  To simplify the logic, we need to move\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\nup, so that the new check to cap the copy length will work for both\ncommands."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T05:23:32.646Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe"
        },
        {
          "url": "https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419"
        }
      ],
      "title": "bnxt_en: Fix out-of-bound memcpy() during ethtool -w",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37911",
    "datePublished": "2025-05-20T15:21:43.278Z",
    "dateReserved": "2025-04-16T04:51:23.967Z",
    "dateUpdated": "2025-05-26T05:23:32.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37911\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:27.610\",\"lastModified\":\"2025-05-21T20:25:16.407\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\\n\\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\\nmemory corruption:\\n\\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\\nethtool_get_dump_data+0xdc/0x1a0\\n__dev_ethtool+0xa1e/0x1af0\\ndev_ethtool+0xa8/0x170\\ndev_ioctl+0x1b5/0x580\\nsock_do_ioctl+0xab/0xf0\\nsock_ioctl+0x1ce/0x2e0\\n__x64_sys_ioctl+0x87/0xc0\\ndo_syscall_64+0x5c/0xf0\\nentry_SYSCALL_64_after_hwframe+0x78/0x80\\n\\n...\\n\\nThis happens when copying the coredump segment list in\\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\\nThe info-\u003edest_buf buffer is allocated based on the number of coredump\\nsegments returned by the FW.  The segment list is then DMA\u0027ed by\\nthe FW and the length of the DMA is returned by FW.  The driver then\\ncopies this DMA\u0027ed segment list to info-\u003edest_buf.\\n\\nIn some cases, this DMA length may exceed the info-\u003edest_buf length\\nand cause the above BUG condition.  Fix it by capping the copy\\nlength to not exceed the length of info-\u003edest_buf.  The extra\\nDMA data contains no useful information.\\n\\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\\nHWRM_DBG_COREDUMP_RETRIEVE FW commands.  The buffering is different\\nfor these 2 FW commands.  To simplify the logic, we need to move\\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\\nup, so that the new check to cap the copy length will work for both\\ncommands.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bnxt_en: Se corrige memcpy() fuera de los l\u00edmite durante ethtool -w Al recuperar el volcado de n\u00facleo de FW con ethtool, a veces puede causar corrupci\u00f3n de memoria: ERROR: KFENCE: corrupci\u00f3n de memoria en __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Memoria corrupta en 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (en kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_es] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... Esto sucede al copiar la lista de segmentos del volcado de n\u00facleo en bnxt_hwrm_dbg_dma_data() con el comando de firmware HWRM_DBG_COREDUMP_LIST. El b\u00fafer info-\u0026gt;dest_buf se asigna seg\u00fan la cantidad de segmentos de volcado de n\u00facleo devueltos por el firmware. El firmware procesa la lista de segmentos mediante DMA y devuelve su longitud. El controlador copia esta lista de segmentos procesada mediante DMA en info-\u0026gt;dest_buf. En algunos casos, esta longitud de DMA puede superar la longitud de info-\u0026gt;dest_buf y causar el error mencionado. Para solucionarlo, limite la longitud de la copia para que no supere la longitud de info-\u0026gt;dest_buf. Los datos DMA adicionales no contienen informaci\u00f3n \u00fatil. Esta ruta de c\u00f3digo es compartida por los comandos de firmware HWRM_DBG_COREDUMP_LIST y HWRM_DBG_COREDUMP_RETRIEVE. El almacenamiento en b\u00fafer es diferente para estos dos comandos de firmware. Para simplificar la l\u00f3gica, necesitamos mover la l\u00ednea para ajustar la longitud del b\u00fafer para HWRM_DBG_COREDUMP_RETRIEVE hacia arriba, de modo que la nueva verificaci\u00f3n para limitar la longitud de la copia funcione para ambos comandos.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.