« Volver al listado

CVE-2025-68819

Estado: AplazadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()

rlen value is a user-controlled value, but dtv5100_i2c_msg() does not check the size of the rlen value. Therefore, if it is set to a value larger than sizeof(st->data), an out-of-bounds vuln occurs for st->data.

Therefore, we need to add proper range checking to prevent this vuln.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L/PR:L sin UI permite escalada local por falta de validación. OOB en buffer permite lectura (C:H) y modificación (I:H) de datos del kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramRestrict File and Directory PermissionsRemote Data StorageExecution PreventionEncrypt Sensitive InformationApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68819",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817",
              "lessThan": "c2c293ea7b61f12cdaad1e99a5b4efc58c88960a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817",
              "lessThan": "c2305b4c5fc15e20ac06c35738e0578eb4323750",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817",
              "lessThan": "61f214a878e96e2a8750bf96a98f78c658dba60c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817",
              "lessThan": "4a54d8fcb093761e4c56eb211cf4e39bf8401fa1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817",
              "lessThan": "fe3e129ab49806aaaa3f22067ebc75c2dfbe4658",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817",
              "lessThan": "ac92151ff2494130d9fc686055d6bbb9743a673e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60688d5e6e6e2ae62f29762d1e3b2aec2dbd3817",
              "lessThan": "b91e6aafe8d356086cc621bc03e35ba2299e4788",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/media/usb/dvb-usb/dtv5100.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.28"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.28",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/media/usb/dvb-usb/dtv5100.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-01-13T16:16:04.210",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4a54d8fcb093761e4c56eb211cf4e39bf8401fa1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/61f214a878e96e2a8750bf96a98f78c658dba60c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ac92151ff2494130d9fc686055d6bbb9743a673e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b91e6aafe8d356086cc621bc03e35ba2299e4788",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c2305b4c5fc15e20ac06c35738e0578eb4323750",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c2c293ea7b61f12cdaad1e99a5b4efc58c88960a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fe3e129ab49806aaaa3f22067ebc75c2dfbe4658",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()\n\nrlen value is a user-controlled value, but dtv5100_i2c_msg() does not\ncheck the size of the rlen value. Therefore, if it is set to a value\nlarger than sizeof(st->data), an out-of-bounds vuln occurs for st->data.\n\nTherefore, we need to add proper range checking to prevent this vuln."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: dvb-usb: dtv5100: corrección de acceso fuera de límites en dtv5100_i2c_msg()\n\nEl valor de rlen es un valor controlado por el usuario, pero dtv5100_i2c_msg() no verifica el tamaño del valor de rlen. Por lo tanto, si se establece en un valor mayor que sizeof(st->data), ocurre una vulnerabilidad de acceso fuera de límites para st->data.\n\nPor lo tanto, necesitamos añadir una verificación de rango adecuada para prevenir esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-07-30T06:24:47.560",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}