CVE-2025-21928
"Intel Ish-Hid Linux Kernel Use-After-Free Vulnerability"
Description
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed.
INFO
Published Date :
April 1, 2025, 4:15 p.m.
Last Modified :
April 16, 2025, 2:15 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-21928.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-21928 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-21928 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 16, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-416 -
Initial Analysis by [email protected]
Apr. 11, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.179 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.235 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.131 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.9 up to (excluding) 5.4.291 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.83 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.19 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.13.7 *cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:* Added Reference Type kernel.org: https://git.kernel.org/stable/c/01b18a330cda61cc21423a7d1af92cf31ded8f60 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/07583a0010696a17fb0942e0b499a62785c5fc9f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/560f4d1299342504a6ab8a47f575b5e6b8345ada Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d3faae7f42181865c799d88c5054176f38ae4625 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/dea6a349bcaf243fff95dfd0428a26be6a0fb44e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 01, 2025
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed. Added Reference https://git.kernel.org/stable/c/01b18a330cda61cc21423a7d1af92cf31ded8f60 Added Reference https://git.kernel.org/stable/c/07583a0010696a17fb0942e0b499a62785c5fc9f Added Reference https://git.kernel.org/stable/c/0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d Added Reference https://git.kernel.org/stable/c/560f4d1299342504a6ab8a47f575b5e6b8345ada Added Reference https://git.kernel.org/stable/c/cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394 Added Reference https://git.kernel.org/stable/c/d3faae7f42181865c799d88c5054176f38ae4625 Added Reference https://git.kernel.org/stable/c/dea6a349bcaf243fff95dfd0428a26be6a0fb44e Added Reference https://git.kernel.org/stable/c/eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-21928 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-21928
weaknesses.