CVE-2025-39684

一、漏洞信息
 漏洞编号：[CVE-2025-39684](https://nvd.nist.gov/vuln/detail/CVE-2025-39684)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V4.0分值：
  BaseScore：N/A None
  Vector：
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`.  A kernelbuffer is allocated to hold `insn->n` samples (each of which is an`unsigned int`).  For some instruction types, `insn->n` samples arecopied back to user-space, unless an error code is being returned.  Theproblem is that not all the instruction handlers that need to returndata to userspace fill in the whole `insn->n` samples, so that there isan information leak.  There is a similar syzbot report for`do_insnlist_ioctl()`, although it does not have a reproducer for it atthe time of writing.One culprit is `insn_rw_emulate_bits()` which is used as the handler for`INSN_READ` or `INSN_WRITE` instructions for subdevices that do not havea specific handler for that instruction, but do have an `INSN_BITS`handler.  For `INSN_READ` it only fills in at most 1 sample, so if`insn->n` is greater than 1, the remaining `insn->n - 1` samples copiedto userspace will be uninitialized kernel data.Another culprit is `vm80xx_ai_insn_read()` in the  vm80xx  driver.  Itnever returns an error, even if it fails to fill the buffer.Fix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making surethat uninitialized parts of the allocated buffer are zeroed beforehandling each instruction.Thanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`.  That fixreplaced the call to `kmalloc_array()` with `kcalloc()`, but it is notalways necessary to clear the whole buffer.
 漏洞公开时间：2025-09-06 02:15:45
 漏洞创建时间：2025-09-06 02:07:57
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-39684
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39684 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38058 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38005 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40104 |  |
|  | https://git.kernel.org/linus/3cd212e895ca2d58963fdc6422502b10dd3966bb |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37861 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49894 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40155 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38109 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-57900 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38350 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39994 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38667 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40049 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40149 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38584 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-42245 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49863 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39677 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40061 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38664 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-21945 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-23133 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38231 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-41079 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49957 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40075 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38470 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39947 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40121 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-40902 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39817 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-42297 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38071 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40074 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38361 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40139 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38282 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-57887 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40135 |  |
|  | https://git.kernel.org/stable/c/ff4a7c18799c7fe999fa56c5cf276e13866b8c1a |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22025 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38633 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-21968 |  |
|  | https://git.kernel.org/stable/c/868a1b68dcd9f2805bb86aa64862402f785d8c4a |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38614 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38381 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49962 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37997 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-50002 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22039 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40058 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40158 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39866 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39881 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-42101 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39697 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025090546-CVE-2025-39684-fcce@gregkh/T/#u |  |
|  | https://git.kernel.org/stable/c/3cd212e895ca2d58963fdc6422502b10dd3966bb |  |
|  | https://advisory.echohq.com/cve/CVE-2025-39684 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2393502 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2803 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39825 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38443 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49935 |  |
|  | https://git.kernel.org/stable/c/f3b0c9ec54736f3b8118f93a473d22e11ee65743 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37899 |  |
|  | https://git.kernel.org/stable/c/aecf0d557ddd95ce68193a5ee1dc4c87415ff08a |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49925 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40052 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38457 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38706 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49905 |  |
|  | https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38477 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22042 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-40904 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39911 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49950 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38588 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38636 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38615 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49948 |  |
|  | https://ubuntu.com/security/CVE-2025-39684 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38566 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49949 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-53131 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38659 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38527 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38727 |  |
|  | https://docs.bell-sw.com/security/cves/CVE-2025-39684 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22043 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39810 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-42102 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-50005 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49875 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025090546-CVE-2025-39684-fcce@gregkh/T |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-42247 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38617 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39675 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://github.com/gregkh/linux/commit/868a1b68dcd9f2805bb86aa64862402f785d8c4a.patch |  | ljqc |
|  |  | https://git.kernel.org/linus/3cd212e895ca2d58963fdc6422502b10dd3966bb |  | osv |
|  |  | https://git.kernel.org/stable/c/ff4a7c18799c7fe999fa56c5cf276e13866b8c1a |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/868a1b68dcd9f2805bb86aa64862402f785d8c4a |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/3cd212e895ca2d58963fdc6422502b10dd3966bb |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/f3b0c9ec54736f3b8118f93a473d22e11ee65743 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/aecf0d557ddd95ce68193a5ee1dc4c87415ff08a |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/d84f6e77ebe3359394df32ecd97e0d76a25283dc |  | cvelistv5 |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in do_insn_ioctl(). A kernel buffer is allocated to hold insn->n samples (each of which is an unsigned int). For some instruction types, insn->n samples are copied back to user-space, unless an error code is being returned. The problem is that not all the instruction handlers that need to return data to userspace fill in the whole insn->n samples, so that there is an information leak. There is a similar syzbot report for do_insnlist_ioctl(), although it does not have a reproducer for it at the time of writing. One culprit is insn_rw_emulate_bits() which is used as the handler for INSN_READ or INSN_WRITE instructions for subdevices that do not have a specific handler for that instruction, but do have an INSN_BITS handler. For INSN_READ it only fills in at most 1 sample, so if insn->n is greater than 1, the remaining insn->n - 1 samples copied to userspace will be uninitialized kernel data. Another culprit is vm80xx_ai_insn_read() in the  vm80xx  driver. It never returns an error, even if it fails to fill the buffer. Fix it in do_insn_ioctl() and do_insnlist_ioctl() by making sure that uninitialized parts of the allocated buffer are zeroed before handling each instruction. Thanks to Arnaud Lecomte for their fix to do_insn_ioctl(). That fix replaced the call to kmalloc_array() with kcalloc(), but it is not always necessary to clear the whole buffer.The Linux kernel CVE team has assigned CVE-2025-39684 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):受影响
3.openEuler-22.03-LTS-SP3(5.10.0):受影响
4.openEuler-22.03-LTS-SP4(5.10.0):受影响
5.openEuler-24.03-LTS(6.6.0):受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):受影响
8.openEuler-24.03-LTS-SP2(6.6.0):受影响
9.openEuler-24.03-LTS-SP3(6.6.0):受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否
9.openEuler-24.03-LTS-SP3(6.6.0):否

原因说明：
  1.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
3.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
4.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
5.openEuler-24.03-LTS(6.6.0):正常修复
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(6.6.0):正常修复
8.openEuler-24.03-LTS-SP2(6.6.0):正常修复
9.openEuler-24.03-LTS-SP3(6.6.0):正常修复

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2803

src-openEuler / kernel
Closed

Content Risk Flag

Comments (12)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-39684

Comments (12)

Search

src-openEuler / kernel
Closed