CVE-2025-39715

Vulnerability

Analysis

CVE-2025-39715 is a vulnerability in the Linux kernel's parisc kernel's parisc architecture. The issue lies in the gateway Lightweighted Lightweight System (LWS) calls, specifically the compare-and-swap operation. The kernel uses load and stbys,e instructions to trigger memory reference interruptions without writing to memory. However, read access interruptions are only triggered at privilege levels 2 and 3, while the kernel and gateway page execute at privilege level 0. Consequently, the code never triggers a read access interruption, allowing user code to execute a LWS compare and swap operation at an address that is read-protected at privilege level 3 (PRIV_USER).

Exploitation

An attacker with local user access on a parisc system could exploit this by crafting a LWS call targeting a read-protected memory region. The attack requires no special privileges beyond user-level access, but the attacker must be able to execute user-space code. The vulnerability is triggered by the kernel's failure to properly probe read access rights before performing the LWS operation.

Impact

Successful exploitation could allow an attacker to perform a compare-and-swap operation on memory that should be read-protected. This could lead to unauthorized modification of kernel or other process memory, potentially resulting in privilege escalation or system instability. The CVSS v3 score of 5.5 (Medium) reflects the need for local access and the potential for significant impact.

Mitigation

The fix, as described in the kernel commit, probes read access rights at privilege level 3 and branches to lws_fault if access is not allowed. The patch has been applied to the stable kernel tree [2][3][4]. Users should update their Linux kernel to a version containing this fix. The vulnerability is also listed as affecting Siemens SIMATIC CN 4100 devices [1], which should apply the vendor-provided remediation.