CVE-2025-38680

Vulnerability

Description

The vulnerability resides in the Linux kernel's UVC (USB Video Class) driver. The function uvc_parse_format() accesses buffer[3] during parsing, but the preceding length check only ensures buflen > 2. Consequently, if a USB video descriptor provides exactly 3 bytes, the driver performs a one-byte out-of-bounds read [1]. This flaw was introduced because the buffer length validation was insufficient for the function's requirements.

Exploitation

Conditions

Exploitation requires a malicious USB video device that supplies a malformed descriptor with a length of exactly 3 bytes. An attacker would need physical access to the system or the ability to emulate a USB device. No authentication is required beyond the USB connection itself. The out-of-bounds read occurs during the parsing of the format descriptor, which is triggered when the device is enumerated.

Impact

An out-of-bounds read can lead to the disclosure of sensitive kernel memory or cause a system crash (denial of service). The CVSS v3 score of 7.1 (High) reflects the potential for significant confidentiality and availability impacts. The Siemens advisory [1] lists this CVE among many affecting the SIMATIC CN 4100 product line.

Mitigation

The fix adds a check for buflen >= 4 in uvc_parse_format(), ensuring the buffer is large enough before accessing index 3. Patches have been applied to the stable kernel trees [2][3][4]. Users should update to the latest kernel version. For affected Siemens products, upgrading to SIMATIC CN 4100 V5.0 remediates the issue [1].