CVE-2025-37947

Published May 20, 2025

Last updated 3 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-37947 is a vulnerability found in the Linux kernel's ksmbd filesystem component, specifically within the `ksmbdvfsstream_write()` function. Disclosed on May 20, 2025, the vulnerability arises from a missing bounds check in the `ksmbdvfsstreamwrite()` function. The function doesn't validate if the write offset (`*pos`) is within the bounds of the existing stream data length (`vlen`). If `*pos` is greater than or equal to `v_len`, it can lead to an out-of-bounds memory write. Successful exploitation of this vulnerability could result in out-of-bounds memory writes in the Linux kernel, potentially causing memory corruption or system crashes. A patch has been implemented to address this issue by adding a validation check for the write offset in `ksmbdvfsstreamwrite()`. The fix ensures that `*pos` is less than `vlen` before proceeding with the write operation, returning `-EINVAL` if the condition fails.

Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating *pos ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data length (v_len). If *pos was greater than or equal to v_len, this could lead to an out-of-bounds memory write. This patch adds a check to ensure *pos is less than v_len before proceeding. If the condition fails, -EINVAL is returned.
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Modified
Products: linux_kernel, debian_linux

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-787
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-787

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2F5F5F42-653E-4296-BD26-A8DF2E290589",
            "versionEndExcluding": "6.1.139",
            "versionStartIncluding": "5.15",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B6826C73-C5C9-430D-84C9-4045DFD72074",
            "versionEndExcluding": "6.6.91",
            "versionStartIncluding": "6.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7215ABCF-8EB1-46CD-8872-8BCE4890E579",
            "versionEndExcluding": "6.12.29",
            "versionStartIncluding": "6.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5715A6F5-A34A-4B27-8A64-82825E963995",
            "versionEndExcluding": "6.14.7",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
            "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
            "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
            "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
            "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*",
            "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.