CVE-2025-62525
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-10-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openwrt | openwrt | to 24.10.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the ltq-ptm driver used by OpenWrt on certain Lantiq/Intel/MaxLinear SoCs operating DSL lines in PTM mode. It allows local users to read and write arbitrary kernel memory through the driver's ioctl interface due to improper input validation and out-of-bounds memory access. This can lead to privilege escalation and potentially escaping sandboxed environments. [4]
How can this vulnerability impact me? :
An attacker with local access could exploit this vulnerability to read and write kernel memory arbitrarily, leading to privilege escalation. This could allow them to escape sandboxed environments like ujail, potentially gaining higher system privileges and causing high availability impact on the device. [4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects OpenWrt systems running versions prior to 24.10.4 on Lantiq target devices using the ltq-ptm driver for DSL lines in PTM mode. Detection involves verifying the OpenWrt version and the presence of the vulnerable ltq-ptm driver. You can check the OpenWrt version with the command `cat /etc/openwrt_release` or `opkg list-installed | grep openwrt`. To check if the ltq-ptm driver is loaded, use `lsmod | grep ltq_ptm`. Since the vulnerability involves ioctl calls allowing arbitrary kernel memory read/write, direct detection via commands is limited. Monitoring for unusual kernel memory access or sandbox escapes may help. No specific detection commands are provided in the resources. [4]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade OpenWrt to version 24.10.4 or later, where the vulnerability has been fixed. There are no workarounds available. Ensuring that your device is not running a vulnerable version and applying the official patches or updates is critical. Additionally, limiting local user access to the device can reduce risk, as the vulnerability requires local user privileges. [4]