CVE-2025-40112

Vulnerability

Description

CVE-2025-40112 addresses a bug in the Linux kernel's SPARC architecture, specifically for Niagara processors. The issue lies in the exception handlers added to copy_from_user and copy_to_user functions. These handlers are invoked when a fault occurs during user-space memory access, and they are responsible for calculating the number of bytes not-yet-copied bytes and returning from the function. However, the initial implementation contained bad calculations and a broken epilogue in the exception handlers, leading to incorrect return values and potential system crashes [1][2][2][3].

Exploitation and

Impact

An attacker who can trigger a fault during a copy operation from or to user space could exploit this flaw. The incorrect exception handling could cause the kernel to miscalculate the number of bytes not copied, potentially leading to memory corruption or information leaks. The vulnerability could be triggered by a user-space program that causes a page fault during a copy operation, for example by accessing an invalid memory region. The impact includes system instability (crashes) and incorrect return values from the copy functions, which could be leveraged for further exploitation [1][2][3].

Mitigation

The fix is included in the Linux kernel stable tree. Users should apply the relevant kernel patches to ensure correct exception handling on SPARC Niagara systems. The memcpy function is not affected by this issue [1][2][3].