CVE-2025-38502

Vulnerability

CVE-2025-38502 is an out-of-bounds (OOB) access vulnerability in the Linux kernel's BPF subsystem, specifically in cgroup local storage handling. The root cause lies in how the BPF verifier validates programs individually but fails to account for mismatched storage sizes when a tail call is made between two programs that each use cgroup local storage with different value sizes. At runtime, the bpf_cg_run_ctx structure holds a bpf_prog_array_item that contains the BPF program and its associated cgroup local storage. When a tail call is made from one program to another, the helper bpf_get_local_storage() retrieves the storage from the original program's map, not the second program's own map, leading to an OOB access if the storage sizes differ [1].

Exploitation

To exploit this vulnerability, an attacker must be able to load and execute BPF programs with tail calls, which typically requires root privileges or CAP_BPF and CAP_NET_ADMIN capabilities. The attack surface involves crafting two BPF programs that each use cgroup local storage with different value sizes, and then arranging for one program to tail-call the other. The verifier does not detect this mismatch because it validates each program in isolation, so the OOB access only occurs at runtime when the tail call is executed [1].

Impact

Successful exploitation could allow an attacker to read or write memory beyond the bounds of the intended storage buffer, potentially leading to information disclosure or privilege escalation. The CVSS v3 score of 7.1 (High) reflects the potential for significant impact on confidentiality, integrity, and availability, though exploitation requires elevated privileges [1].

Mitigation

The fix involves extending bpf_map_owner with an array of storage_cookie[] to match the exact maps from the original program, or to allow the tail call combination if the second program does not use any cgroup local storage maps. Patches have been committed to the Linux kernel stable branches [2][3][4]. Users should update to the latest kernel version that includes the fix. The vulnerability is also listed in Siemens' advisory SSA-032379, affecting SIMATIC CN 4100 devices, which should apply the vendor-provided remediation [1].