Executive brief
A vulnerability in the Linux kernel's USB storage driver for SDDR-55 devices could allow a malicious USB device to corrupt system memory. By providing a specially crafted response during a data write operation, a 'bogus' device can cause the operating system to crash or potentially execute unauthorized code. This requires physical access to plug the malicious device into the target system.
Technical details
A heap-based out-of-bounds write vulnerability exists in the sddr55_write_data function within drivers/usb/storage/sddr55.c. The driver fails to validate the 'new_pba' (Physical Block Address) value returned in the status packet from the USB device after a write operation. An attacker with physical access can use a malicious USB device to return a PBA value exceeding the allocated 'pba_to_lba' array size, leading to heap corruption. This can result in a kernel panic or potential local privilege escalation. The fix introduces a bounds check against the computed block count derived from the device's reported capacity.
Affected products
- Linux Linux Kernel All versions prior to fixed releases in 6.12, 6.11, 6.6, 6.1, 5.15, 5.10, 5.4, and 4.19 branches
Timeline
- 2025-11-16: other: Vulnerability discovered and patch submitted by Tianchu Chen
- 2025-12-12: advisory: NVD published CVE-2025-40345
- 2025-12-07: patched: Patch merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/04a8a6393f3f2f471e05eacca33282dd30b01432
- https://git.kernel.org/stable/c/26e9b5da3231da7dc357b363883b5b7b51a64092
- https://git.kernel.org/stable/c/5ebe8d479aaf4f41ac35e6955332304193c646f6
- https://git.kernel.org/stable/c/a20f1dd19d21dcb70140ea5a71b1f8cbe0c7e68f
- https://git.kernel.org/stable/c/aa64e0e17e3a5991a25e6a46007770c629039869
- https://git.kernel.org/stable/c/b59d4fda7e7d0aff1043a7f742487cb829f5aac1
- https://git.kernel.org/stable/c/d00a6c04a502cd52425dbf35588732c652b16490