CVE-2025-68816

Vulnerability

Description

In the Linux kernel, the mlx5 firmware tracer component lacked validation of format string parameters received from the device firmware. The firmware tracer uses these format strings to construct trace messages, but it did not enforce restrictions on allowed format specifiers. An invalid or malicious firmware could supply format strings containing specifiers like %s, %p, or %n, which can read arbitrary memory or cause undefined behavior when processed by the kernel's printk-family functions [1].

Exploitation

Prerequisites

Exploitation requires a compromised or custom firmware image loaded on the Mellanox ConnectX adapter. In typical datacenter deployments, firmware is signed and verified, but a vulnerability in firmware loading or a malicious insider could provide malformed strings. No user-level authentication is needed beyond physical or administrative access to the device. Once the device sends a trace message with an invalid format string, the kernel will process it, leading to a crash or information disclosure [2].

Impact

A successful attack results in a kernel panic or potential exposure of kernel memory contents (e.g., via %s reading arbitrary memory). The fix adds mlx5_tracer_validate_params() to reject unsafe specifiers and prefix invalid strings with "BAD_FORMAT: " in the trace output, preventing exploitation [1].

Mitigation

The patch has been applied to the Linux kernel stable tree. Users should update to a version containing commit 768d559f466c or backport it. No workaround exists other than disabling firmware tracing, which may not be possible in all environments.