Junglewise Threat Intelligence

CVE-2025-38715: Linux Kernel slab-out-of-bounds in HFS bnode operations

CVE-2025-38715 · Severity: high · CVSS 7.8 · Published 2025-09-04

Technologies: Siemens SIMATIC CN 4100, Linux Kernel. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's HFS file system driver, which is used to read and write older Apple-formatted disks. An attacker with local access to a system could exploit this flaw to cause a system crash or potentially access sensitive information from the computer's memory. This could lead to a loss of system availability or unauthorized data exposure.

Technical details

A slab-out-of-bounds access vulnerability exists in the Linux kernel HFS file system implementation within 'fs/hfs/bnode.c'. The issue stems from missing validation of offset and length parameters in functions such as hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move(). A local attacker with low privileges can trigger these out-of-bounds accesses by providing specially crafted HFS filesystem structures. This can result in a kernel crash (DoS) or the leakage of sensitive kernel memory. The fix introduces 'is_bnode_offset_valid()' and 'check_and_correct_requested_length()' to enforce bounds checking on all bnode operations. Patches have been released for multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 2.6.12 to 6.13.y
  • Siemens SIMATIC CN 4100 before V5.0

Timeline

  • 2025-07-03: disclosed: Initial patch submitted by Viacheslav Dubeyko
  • 2025-08-28: patched: Commits merged into stable kernel trees by Greg Kroah-Hartman
  • 2025-09-04: advisory: CVE-2025-38715 published

References

Related threats