CVE-2025-38487

soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled

Severity Score

5.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled Mitigate e.g. the following: # echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind ... [ 120.363594] Unable to handle kernel NULL pointer dereference at virtual address 00000004 when write [ 120.373866] [00000004] *pgd=00000000 [ 120.377910] Internal error: Oops: 805 [#1] SMP ARM [ 120.383306] CPU: 1 UID: 0 PID: 315 Comm: sh Not tainted 6.15.0-rc1-00009-g926217bc7d7d-dirty #20 NONE ... [ 120.679543] Call trace: [ 120.679559] misc_deregister from aspeed_lpc_snoop_remove+0x84/0xac [ 120.692462] aspeed_lpc_snoop_remove from platform_remove+0x28/0x38 [ 120.700996] platform_remove from device_release_driver_internal+0x188/0x200 ...

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: soc: aspeed: lpc-snoop: No deshabilite los canales que no están habilitados. Mitigar, por ejemplo, lo siguiente: # echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind ... [ 120.363594] No se puede controlar la desreferencia del puntero NULL del kernel en la dirección virtual 00000004 al escribir [ 120.373866] [00000004] *pgd=00000000 [ 120.377910] Error interno: Oops: 805 [#1] SMP ARM [ 120.383306] CPU: 1 UID: 0 PID: 315 Comm: sh No contaminado 6.15.0-rc1-00009-g926217bc7d7d-dirty #20 NINGUNO ... [ 120.679543] Rastreo de llamadas: [ 120.679559] misc_deregister de aspeed_lpc_snoop_remove+0x84/0xac [ 120.692462] aspeed_lpc_snoop_remove de platform_remove+0x28/0x38 [ 120.700996] platform_remove de device_release_driver_internal+0x188/0x200 ...

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this to expose sensitive information from the host OS.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2025-04-16 CVE Reserved
2025-07-28 CVE Published
2025-11-03 CVE Updated
2026-04-23 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (9)

URL	Tag	Source
https://git.kernel.org/stable/c/9f4f9ae81d0affc182f54dd00285ddb90e0b3ae1	Vuln. Introduced

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/62e51f51d97477ea4e78c82e7076a171dac86c75	2025-08-28
https://git.kernel.org/stable/c/9e1d2b97f5e2a36a2fd30a8bd30ead9dac5e3a51	2025-08-28
https://git.kernel.org/stable/c/166afe964e8433d52c641f5d1c09102bacee9a92	2025-08-28
https://git.kernel.org/stable/c/dc5598482e2d3b234f6d72d6f5568e24f603e51a	2025-07-24
https://git.kernel.org/stable/c/329a80adc0e5f815d0514a6d403aaaf0995cd9be	2025-07-24
https://git.kernel.org/stable/c/b361598b7352f02456619a6105c7da952ef69f8f	2025-07-24
https://git.kernel.org/stable/c/ac10ed9862104936a412f8b475c869e99f048448	2025-07-24
https://git.kernel.org/stable/c/56448e78a6bb4e1a8528a0e2efe94eff0400c247	2025-07-02

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.13 < 5.4.297 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 5.4.297"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.13 < 5.10.241 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 5.10.241"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.13 < 5.15.190 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 5.15.190"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.13 < 6.1.147 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 6.1.147"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.13 < 6.6.100 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 6.6.100"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.13 < 6.12.40 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 6.12.40"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.13 < 6.15.8 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 6.15.8"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 4.13 < 6.16 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.13 < 6.16"		en		Affected