CVE-2025-38183

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-38183
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38183.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38183
Downstream
Related
Published
2025-07-04T14:15:25Z
Modified
2025-08-12T21:01:38Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

net: lan743x: fix potential out-of-bounds write in lan743xptpioeventclock_get()

Before calling lan743xptpioeventclockget(), the 'channel' value is checked against the maximum value of PCI11X1XPTPIOMAXCHANNELS(8). This seems correct and aligns with the PTP interrupt status register (PTPINT_STS) specifications.

However, lan743xptpioeventclockget() writes to ptp->extts[] with only LAN743XPTPNEXTTS(4) elements, using channel as an index:

lan743x_ptp_io_event_clock_get(..., u8 channel,...)
{
    ...
    /* Update Local timestamp */
    extts = &ptp->extts[channel];
    extts->ts.tv_sec = sec;
    ...
}

To avoid an out-of-bounds write and utilize all the supported GPIO inputs, set LAN743XPTPN_EXTTS to 8.

Detected using the static analysis tool - Svace.

References

Affected packages