CVE-2025-37838
Linux HSI ssi_protocol Use After Free Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function within the ssip_pn_ops structure is capable of starting the work. If we remove the module which will call ssi_protocol_remove() to make a cleanup, it will free ssi through kfree(ssi), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | ssip_xmit_work ssi_protocol_remove | kfree(ssi); | | struct hsi_client *cl = ssi->cl; | // use ssi Fix it by ensuring that the work is canceled before proceeding with the cleanup in ssi_protocol_remove().
INFO
Published Date :
April 18, 2025, 3:15 p.m.
Last Modified :
May 2, 2025, 7:16 a.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
Public PoC/Exploit Available at Github
CVE-2025-37838 has a 1 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-37838.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
DSA and DLA for Debian last 14 days
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-37838 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-37838 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 02, 2025
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/4a8c29beb8a02b5a0a9d77d608aa14b6f88a6b86 Added Reference https://git.kernel.org/stable/c/72972552d0d0bfeb2dec5daf343a19018db36ffa Added Reference https://git.kernel.org/stable/c/d03abc1c2b21324550fa71e12d53e7d3498e0af6 -
Initial Analysis by [email protected]
Apr. 25, 2025
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 6.1.135 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.13.12 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.14 up to (excluding) 6.14.3 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.88 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.24 Added Reference Type kernel.org: https://git.kernel.org/stable/c/4b4194c9a7a8f92db39e8e86c85f4fb12ebbec4f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/58eb29dba712ab0f13af59ca2fe545f5ce360e78 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/834e602d0cc7c743bfce734fad4a46cefc0f9ab1 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ae5a6a0b425e8f76a9f0677e50796e494e89b088 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d58493832e284f066e559b8da5ab20c15a2801d3 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e3f88665a78045fe35c7669d2926b8d97b892c11 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 25, 2025
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/58eb29dba712ab0f13af59ca2fe545f5ce360e78 Added Reference https://git.kernel.org/stable/c/d58493832e284f066e559b8da5ab20c15a2801d3 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Apr. 21, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-416 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 20, 2025
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/4b4194c9a7a8f92db39e8e86c85f4fb12ebbec4f Added Reference https://git.kernel.org/stable/c/834e602d0cc7c743bfce734fad4a46cefc0f9ab1 Added Reference https://git.kernel.org/stable/c/ae5a6a0b425e8f76a9f0677e50796e494e89b088
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-37838 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-37838
weaknesses.