CVE-2025-38715

Vulnerability

Details

The Linux kernel's HFS filesystem implementation contains a slab-out-of-bounds vulnerability in the hfs_bnode_read() function. The issue arises because the function does not validate the offset and length parameters before accessing the bnode data buffer, potentially leading to reads beyond the allocated memory. The fix introduces two new helper functions: is_bnode_offset_valid() checks the requested offset, and check_and_correct_requested_length() ensures the length does not exceed the buffer boundaries.

Exploitation

An attacker could exploit this vulnerability by mounting a specially crafted HFS filesystem image that triggers an out-of-bounds read when the kernel attempts to read a bnode with an invalid offset or length. The attack requires the ability to mount a malicious HFS filesystem, which typically necessitates local access or the ability to insert a storage device.

Impact

Successful exploitation could lead to a kernel crash (denial of service) or potentially information disclosure if the out-of-bounds read accesses sensitive kernel memory. The CVSS score of 7.1 (High) reflects the potential for significant impact.

Mitigation

The fix has been committed to the Linux kernel stable tree. Users should update to the latest kernel version containing the patch. This vulnerability is also listed in Siemens advisory SSA-032379 [1], which identifies affected Siemens products such as SIMATIC CN 4100.