5.5
CVE-2025-37813
- EPSS 0.19%
- Veröffentlicht 08.05.2025 06:26:10
- Zuletzt bearbeitet 30.07.2026 06:22:21
- Erkennungen
usb: xhci: Fix invalid pointer dereference in Etron workaround
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix invalid pointer dereference in Etron workaround This check is performed before prepare_transfer() and prepare_ring(), so enqueue can already point at the final link TRB of a segment. And indeed it will, some 0.4% of times this code is called. Then enqueue + 1 is an invalid pointer. It will crash the kernel right away or load some junk which may look like a link TRB and cause the real link TRB to be replaced with a NOOP. This wouldn't end well. Use a functionally equivalent test which doesn't dereference the pointer and always gives correct result. Something has crashed my machine twice in recent days while playing with an Etron HC, and a control transfer stress test ran for confirmation has just crashed it again. The same test passes with this patch applied.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.6.66 < 6.6.89
Linux ≫ Linux Kernel Version >= 6.11.11 < 6.12
Linux ≫ Linux Kernel Version >= 6.12.2 < 6.12.26
Linux ≫ Linux Kernel Version >= 6.13 < 6.14.5
Linux ≫ Linux Kernel Version 6.15 Update rc1
Linux ≫ Linux Kernel Version 6.15 Update rc2
Linux ≫ Linux Kernel Version 6.15 Update rc3
VulnDex Vulnerability Enrichment
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.19% | 0.084 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
|
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-476 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
https://git.kernel.org/stable/c/142273a49f2c315eabdbdf5a71c15e479b75ca91
https://git.kernel.org/stable/c/bce3055b08e303e28a8751f6073066f5c33a0744
https://git.kernel.org/stable/c/0624e29c595b05e7a0e6d1c368f0a05799928e30
https://git.kernel.org/stable/c/1ea050da5562af9b930d17cbbe9632d30f5df43a