CVE-2025-68352
Unknown Unknown - Not Provided
Out-of-Bounds Read/Write in Linux Kernel ch341 SPI Driver

Publication date: 2025-12-24

Last updated on: 2025-12-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Discovered by Atuin - Automated Vulnerability Discovery Engine. The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header. When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len' as the length is incorrect because: 1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size 'trans->len', i.e., 'len - 1' in this context). 2. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1 overflows the buffer. Fix this by copying 'len - 1' bytes.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-24
Last Modified
2025-12-24
Generated
2026-05-07
AI Q&A
2025-12-24
EPSS Evaluated
2026-05-05
NVD
CVE-2025-68352
EUVD
EUVD-2025-205102
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an out-of-bounds memory access issue in the Linux kernel's spi ch341 driver. Specifically, the code incorrectly calculates the length of data to copy, leading to reading beyond the source buffer and potentially writing beyond the destination buffer. This happens because the length variable includes an extra byte for a command header, causing the copy operation to exceed buffer boundaries. The fix involves adjusting the copy length to avoid these out-of-bounds accesses.


How can this vulnerability impact me? :

This vulnerability can lead to memory corruption due to out-of-bounds reads and writes. Such memory corruption can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, update the Linux kernel to a version where the ch341 driver has been fixed to correctly handle the buffer length by copying 'len - 1' bytes instead of 'len'. This prevents out-of-bounds memory access. Avoid using vulnerable kernel versions and apply vendor patches or kernel updates as soon as they become available.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart