« Volver al listado

CVE-2025-38556

Estado: ModificadaAlta (7.1)—

In the Linux kernel, the following vulnerability has been resolved:

HID: core: Harden s32ton() against conversion to 0 bits

Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that.

Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L/PR:L: escalada local. Crash en s32ton() permite DoS (shift-out-of-bounds exception). Dispositivo HID malformado o atacante local puede provocar kernel panic, denegando servicio.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-38556",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-38556",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-10T20:41:53.944834Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "lessThan": "6cdf6c708717c5c6897d0800a1793e83757c7491",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "lessThan": "eeeaba737919bdce9885e2a00ac2912f61a3684d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "lessThan": "3c86548a20d7bc2861aa4de044991a327bebad1a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "lessThan": "810189546cb6c8f36443ed091d91f1f5d2fc2ec7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "lessThan": "d3b504146c111548ab60b6ef7aad00bfb1db05a2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "lessThan": "8b4a94b1510f6a46ec48494b52ee8f67eb4fc836",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "lessThan": "865ad8469fa24de1559f247d9426ab01e5ce3a56",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dde5845a529ff753364a6d1aea61180946270bfa",
              "lessThan": "a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.20"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.20",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.119",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver",
              "lessThanOrEqual": "6.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver",
              "lessThanOrEqual": "6.16.*"
            },
            {
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-08-19T17:15:31.817",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3c86548a20d7bc2861aa4de044991a327bebad1a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6cdf6c708717c5c6897d0800a1793e83757c7491",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/810189546cb6c8f36443ed091d91f1f5d2fc2ec7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/865ad8469fa24de1559f247d9426ab01e5ce3a56",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8b4a94b1510f6a46ec48494b52ee8f67eb4fc836",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3b504146c111548ab60b6ef7aad00bfb1db05a2",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eeeaba737919bdce9885e2a00ac2912f61a3684d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Harden s32ton() against conversion to 0 bits\n\nTesting by the syzbot fuzzer showed that the HID core gets a\nshift-out-of-bounds exception when it tries to convert a 32-bit\nquantity to a 0-bit quantity.  Ideally this should never occur, but\nthere are buggy devices and some might have a report field with size\nset to zero; we shouldn't reject the report or the device just because\nof that.\n\nInstead, harden the s32ton() routine so that it returns a reasonable\nresult instead of crashing when it is called with the number of bits\nset to 0 -- the same as what snto32() does."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: núcleo: Reforzar s32ton() contra la conversión a 0 bits. Las pruebas realizadas por el fuzzer syzbot mostraron que el núcleo HID recibe una excepción de desplazamiento fuera de los límites al intentar convertir una cantidad de 32 bits a una cantidad de 0 bits. Idealmente, esto nunca debería ocurrir, pero existen dispositivos con errores y algunos podrían tener un campo de informe con un tamaño establecido en cero; no deberíamos rechazar el informe ni el dispositivo solo por eso. En su lugar, reforzar la rutina s32ton() para que devuelva un resultado razonable en lugar de bloquearse al llamarla con el número de bits establecido en 0, igual que ocurre con snto32()."
    }
  ],
  "lastModified": "2026-06-17T09:17:06.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD3BA7EB-EFB0-46CB-8079-C9D3121A3ABB",
              "versionEndExcluding": "6.12.46",
              "versionStartIncluding": "2.6.20"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5890C690-B295-40C2-9121-FF5F987E5142",
              "versionEndExcluding": "6.15.10",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58182352-D7DF-4CC9-841E-03C1D852C3FB",
              "versionEndExcluding": "6.16.1",
              "versionStartIncluding": "6.16"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}