CVE-2025-21704
Linux Kernel usb-cdc-acm Memory Corruption Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory corruption when the expected_size decreases between fragments, causing `expected_size - acm->nb_index` to wrap. This issue has been present since the beginning of git history; however, it only leads to memory corruption since commit ea2583529cd1 ("cdc-acm: reassemble fragmented notifications"). A mitigating factor is that acm_ctrl_irq() can only execute after userspace has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will do that automatically depending on the USB device's vendor/product IDs and its other interfaces.
INFO
Published Date :
Feb. 22, 2025, 10:15 a.m.
Last Modified :
March 25, 2025, 1:15 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
Exploitability Score :
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-21704.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-21704 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-21704 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 25, 2025
Action Type Old Value New Value Added Reference https://project-zero.issues.chromium.org/issues/395107243 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 13, 2025
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/871619c2b78fdfe05afb4e8ba548678687beb812 Added Reference https://git.kernel.org/stable/c/90dd2f1b7342b9a671a5ea4160f408037b92b118 Added Reference https://git.kernel.org/stable/c/a4e1ae5c0533964170197e4fb4f33bc8c1db5cd2 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Feb. 22, 2025
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory corruption when the expected_size decreases between fragments, causing `expected_size - acm->nb_index` to wrap. This issue has been present since the beginning of git history; however, it only leads to memory corruption since commit ea2583529cd1 ("cdc-acm: reassemble fragmented notifications"). A mitigating factor is that acm_ctrl_irq() can only execute after userspace has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will do that automatically depending on the USB device's vendor/product IDs and its other interfaces. Added Reference https://git.kernel.org/stable/c/383d516a0ebc8641372b521c8cb717f0f1834831 Added Reference https://git.kernel.org/stable/c/6abb510251e75f875797d8983a830e6731fa281c Added Reference https://git.kernel.org/stable/c/7828e9363ac4d23b02419bf2a45b9f1d9fb35646 Added Reference https://git.kernel.org/stable/c/e563b01208f4d1f609bcab13333b6c0e24ce6a01 Added Reference https://git.kernel.org/stable/c/f64079bef6a8a7823358c3f352ea29a617844636
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-21704 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-21704
weaknesses.