CVE-2025-38422 (GCVE-0-2025-38422)
Vulnerability from cvelistv5
Published
2025-07-25 14:16
Modified
2026-08-05 12:01
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb and 64 Kb respectively. Adjust max size definitions and return correct EEPROM length based on device. Also prevent out-of-bound read/write.
References
Impacted products
Vendor Product Version
Linux Linux Version: 695846047aa9b4bb387473a9fd227a51ae7de5e9
Version: 695846047aa9b4bb387473a9fd227a51ae7de5e9
Version: 695846047aa9b4bb387473a9fd227a51ae7de5e9
Version: 695846047aa9b4bb387473a9fd227a51ae7de5e9
Version: 695846047aa9b4bb387473a9fd227a51ae7de5e9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:52.511Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microchip/lan743x_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b4201d74d0a49af2123abf2c9d142e59566714b",
              "status": "affected",
              "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9",
              "versionType": "git"
            },
            {
              "lessThan": "088279ff18cdc437d6fac5890e0c52c624f78a5b",
              "status": "affected",
              "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9",
              "versionType": "git"
            },
            {
              "lessThan": "51318d644c993b3f7a60b8616a6a5adc1e967cd2",
              "status": "affected",
              "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9",
              "versionType": "git"
            },
            {
              "lessThan": "9c41d2a2aa3817946eb613522200cab55513ddaa",
              "status": "affected",
              "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9",
              "versionType": "git"
            },
            {
              "lessThan": "3b9935586a9b54d2da27901b830d3cf46ad66a1e",
              "status": "affected",
              "version": "695846047aa9b4bb387473a9fd227a51ae7de5e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microchip/lan743x_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices\n\nMaximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb\nand 64 Kb respectively. Adjust max size definitions and return correct\nEEPROM length based on device. Also prevent out-of-bound read/write."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable accessors are reachable only through the `SIOCETHTOOL` ioctl (`ETHTOOL_GEEPROM`/`ETHTOOL_SEEPROM`) issued on a local socket against a local lan743x/PCI11x1x netdev. There is no packet-driven or remote path into `lan743x_hs_otp_*`/`lan743x_hs_eeprom_*`.\nAC:L - The attacker simply supplies the offset and length fields in `struct ethtool_eeprom`; the per-byte loop then walks the device address space deterministically. No race, timing window, or memory-layout condition outside the attacker\u0027s control is involved.\nPR:L - The gate is `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)` in `__dev_ethtool()`, a namespace-relative capability that an unprivileged user holds as root of a user namespace owning the netns, and physical NICs are routinely delegated to such containers. This is not real root in the initial namespace.\nUI:N - The attacker drives the whole sequence from their own process with a socket and one ioctl. No action by any other user or victim is required.\nS:U - The unchecked accesses stay within the kernel driver\u0027s own authority over the device it already manages; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The missing `offset + length` validation lets `lan743x_hs_otp_read()`/`lan743x_hs_eeprom_read()` read kilobytes of device OTP/EEPROM outside the region the interface is meant to expose, and the ethtool core copies every byte back to userspace via `copy_to_user()`. The disclosure is not bounded to a few bytes.\nI:H - The same unvalidated offset drives `lan743x_hs_otp_write()`/`lan743x_hs_eeprom_write()`, producing out-of-bounds writes into device non-volatile storage; because OTP programming blows fuses irreversibly (and the 10-bit address mask aliases out-of-range offsets onto live rows), device-stored MAC/PHY provisioning is permanently and unauthorizedly altered.\nA:H - Out-of-bounds programming of the OTP/EEPROM leaves the NIC with invalid stored configuration, so the driver fails to bring the interface up and network connectivity is lost. Since blown OTP fuses cannot be cleared, this denial of service is permanent and persists across reboot and driver reload."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:46.048Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b4201d74d0a49af2123abf2c9d142e59566714b"
        },
        {
          "url": "https://git.kernel.org/stable/c/088279ff18cdc437d6fac5890e0c52c624f78a5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/51318d644c993b3f7a60b8616a6a5adc1e967cd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c41d2a2aa3817946eb613522200cab55513ddaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b9935586a9b54d2da27901b830d3cf46ad66a1e"
        }
      ],
      "title": "net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38422",
    "datePublished": "2025-07-25T14:16:43.109Z",
    "dateReserved": "2025-04-16T04:51:24.014Z",
    "dateUpdated": "2026-08-05T12:01:46.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.