CVE-2025-40082

一、漏洞信息
 漏洞编号：[CVE-2025-40082](https://nvd.nist.gov/vuln/detail/CVE-2025-40082)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V4.0分值：
  BaseScore：N/A None
  Vector：
 漏洞简述：
  In the Linux kernel, a slab-out-of-bounds read vulnerability exists in the hfsplus_uni2asc() function of the HFS+ filesystem. When hfsplus_uni2asc is called from hfsplus_listxattr, it passes a struct hfsplus_attr_unistr* pointer, whose size differs from hfsplus_unistr structure. This mismatch causes the pointer to go beyond the allocated memory boundary, resulting in out-of-bounds read.
 漏洞公开时间：2025-10-28 20:15:42
 漏洞创建时间：2025-10-28 20:52:11
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-40082
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40204 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40200 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38705 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40055 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40141 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37828 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39694 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38011 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40110 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40082 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40134 |  |
|  | https://git.kernel.org/stable/c/857aefc70d4ae3b9bf1ae67434d27d0f79f80c9e |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40169 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2765 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40179 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40120 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40192 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38729 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40171 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2406755 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40178 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40125 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40129 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40187 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-21915 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40183 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40164 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39703 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38234 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40035 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40140 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025102820-CVE-2025-40082-3f03@gregkh/T/#u |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40211 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38349 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38214 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40048 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40201 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38100 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37839 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40109 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37891 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39964 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37785 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39931 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39940 |  |
|  | https://git.kernel.org/stable/c/bea3e1d4467bcf292c8e54f080353d556d355e26 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40176 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38173 |  |
|  | https://advisory.echohq.com/cve/CVE-2025-40082 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2766 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025102820-CVE-2025-40082-3f03@gregkh/T |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40123 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38084 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40088 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39751 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40084 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38581 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40167 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-40082 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40194 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40173 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37812 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40190 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-36357 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40198 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2767 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39938 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40153 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40053 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-23150 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22080 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40202 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37863 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40206 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38717 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39692 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40012 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40043 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39992 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/857aefc70d4ae3b9bf1ae67434d27d0f79f80c9e |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/bea3e1d4467bcf292c8e54f080353d556d355e26 |  | ljqc |
|  |  | https://git.kernel.org/stable/c/857aefc70d4ae3b9bf1ae67434d27d0f79f80c9e |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/bea3e1d4467bcf292c8e54f080353d556d355e26 |  | cvelistv5 |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186Read of size 2 at addr ffff8880289ef218 by task syz.6.248/14290CPU: 0 UID: 0 PID: 14290 Comm: syz.6.248 Not tainted 6.16.4 #1 PREEMPT(full)Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014Call Trace:<TASK>__dump_stack lib/dump_stack.c:94 [inline]dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120print_address_description mm/kasan/report.c:378 [inline]print_report+0xca/0x5f0 mm/kasan/report.c:482kasan_report+0xca/0x100 mm/kasan/report.c:595hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186hfsplus_listxattr+0x5b6/0xbd0 fs/hfsplus/xattr.c:738vfs_listxattr+0xbe/0x140 fs/xattr.c:493listxattr+0xee/0x190 fs/xattr.c:924filename_listxattr fs/xattr.c:958 [inline]path_listxattrat+0x143/0x360 fs/xattr.c:988do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94entry_SYSCALL_64_after_hwframe+0x77/0x7fRIP: 0033:0x7fe0e9fae16dCode: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007fe0eae67f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3RAX: ffffffffffffffda RBX: 00007fe0ea205fa0 RCX: 00007fe0e9fae16dRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000RBP: 00007fe0ea0480f0 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000R13: 00007fe0ea206038 R14: 00007fe0ea205fa0 R15: 00007fe0eae48000</TASK>Allocated by task 14290:kasan_save_stack+0x24/0x50 mm/kasan/common.c:47kasan_save_track+0x14/0x30 mm/kasan/common.c:68poison_kmalloc_redzone mm/kasan/common.c:377 [inline]__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394kasan_kmalloc include/linux/kasan.h:260 [inline]__do_kmalloc_node mm/slub.c:4333 [inline]__kmalloc_noprof+0x219/0x540 mm/slub.c:4345kmalloc_noprof include/linux/slab.h:909 [inline]hfsplus_find_init+0x95/0x1f0 fs/hfsplus/bfind.c:21hfsplus_listxattr+0x331/0xbd0 fs/hfsplus/xattr.c:697vfs_listxattr+0xbe/0x140 fs/xattr.c:493listxattr+0xee/0x190 fs/xattr.c:924filename_listxattr fs/xattr.c:958 [inline]path_listxattrat+0x143/0x360 fs/xattr.c:988do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94entry_SYSCALL_64_after_hwframe+0x77/0x7fWhen hfsplus_uni2asc is called from hfsplus_listxattr,it actually passes in a struct hfsplus_attr_unistr*.The size of the corresponding structure is different from that of hfsplus_unistr,so the previous fix (94458781aee6) is insufficient.The pointer on the unicode buffer is still going beyond the allocated memory.This patch introduces two warpper functions hfsplus_uni2asc_xattr_str andhfsplus_uni2asc_str to process two unicode buffers,struct hfsplus_attr_unistr* and struct hfsplus_unistr* respectively.When ustrlen value is bigger than the allocated memory size,the ustrlen value is limited to an safe size.
 openEuler评分：
  5.5
 Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-24.03-LTS-SP1(6.6.0):受影响
3.openEuler-24.03-LTS-SP2(6.6.0):受影响
4.openEuler-24.03-LTS-SP3(6.6.0):受影响
5.master(6.12.33):不受影响
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响
7.openEuler-22.03-LTS-SP3(5.10.0):不受影响
8.openEuler-22.03-LTS-SP4(5.10.0):不受影响
9.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否
9.openEuler-24.03-LTS-SP3(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.openEuler-24.03-LTS-SP3(6.6.0):正常修复
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响-组件不存在
6.openEuler-22.03-LTS-SP3(5.10.0):不受影响-组件不存在
7.openEuler-22.03-LTS-SP4(5.10.0):不受影响-组件不存在
8.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
9.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2767

src-openEuler / kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-40082

Comments (7)

Search

src-openEuler / kernel
Closed