Junglewise Threat Intelligence

CVE-2025-39683: Linux Kernel slab-out-of-bounds read in ftrace tracing subsystem

CVE-2025-39683 · Severity: high · CVSS 7.8 · Published 2025-09-05

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC CN 4100, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's tracing subsystem, which is used by administrators and developers to monitor system performance and behavior. An attacker with local access to the system could provide a specially crafted, overly long input to the tracing configuration that causes the system to read memory outside of its intended boundaries. This could lead to a system crash (denial of service) or potentially allow the attacker to view sensitive information stored in the system's memory.

Technical details

An out-of-bounds (OOB) read vulnerability exists in the Linux kernel tracing subsystem due to improper error handling in the 'trace_get_user' function. When a user writes a string exceeding FTRACE_BUFF_MAX to 'set_ftrace_filter', 'trace_get_user' fails but neglects to null-terminate the 'parser->buffer'. Subsequent calls to 'ftrace_regex_release', 'ftrace_process_regex', and 'strsep' then trigger an OOB access when searching for delimiters. This is a local vulnerability requiring low privileges. Patches have been released for various stable kernel branches (e.g., 6.1.y, 5.15.y, etc.) to implement a failure flag that limits buffer access upon error.

Affected products

  • Linux Linux Kernel 6.16.0-g6bcdbd62bd56-dirty and earlier versions
  • Siemens SIMATIC CN 4100 before V5.0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5 and later
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later

Timeline

  • 2025-08-23: patched: Initial patch authored by Pu Lehui
  • 2025-09-05: disclosed: CVE published to NVD

References

Related threats