Executive brief
A vulnerability in the Linux kernel's SPI driver for Freescale CPM controllers could allow a buffer overflow. This occurs when the system incorrectly handles data transfers of an odd size, potentially leading to system instability or unauthorized memory access. The issue specifically affects certain industrial hardware and embedded systems using these specific processors.
Technical details
A buffer overflow exists in the fsl-cpm SPI driver (drivers/spi/spi-fsl-spi.c) due to a missing parity check on transfer lengths. The driver incorrectly switches to 16-bit mode for large transfers without verifying if the length is even. When used with components like the at25 EEPROM driver that utilize dynamically allocated bounce buffers sized exactly to the transfer length, an odd-sized transfer causes the driver to write beyond the buffer boundaries. This is a regression from commit fc96ec826bce and is resolved by ensuring the driver remains in 8-bit mode for odd-length transfers.
Affected products
- Linux Linux 60afe299bb54, 4badd33929c0, 7f6738e003b3, fc96ec826bce
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-11-20: patched: Initial fix authored by Christophe Leroy
- 2026-01-13: disclosed: CVE-2025-68773 published
References
- https://git.kernel.org/stable/c/1417927df8049a0194933861e9b098669a95c762
- https://git.kernel.org/stable/c/3dd6d01384823e1bd8602873153d6fc4337ac4fe
- https://git.kernel.org/stable/c/743cebcbd1b2609ec5057ab474979cef73d1b681
- https://git.kernel.org/stable/c/837a23a11e0f734f096c7c7b0778d0e625e3dc87
- https://git.kernel.org/stable/c/9c34a4a2ead00979d203a8c16bea87f0ef5291d8
- https://git.kernel.org/stable/c/be0b613198e6bfa104ad520397cab82ad3ec1771
- https://git.kernel.org/stable/c/c8f1d35076b78df61ace737e41cc1f4b7b63236c