CVE-2025-37846

{"id": "CVE-2025-37846", "cveTags": [], "metrics": {}, "published": "2025-05-09T07:16:05.430", "references": [{"url": "https://git.kernel.org/stable/c/43267d934eacff6c70e15545d804ebbcab8a0bf5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5f6022a74147675124b781fdc056b291850e7786", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a13bfa4fe0d6949cea14718df2d1fe84c38cd113", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/eec737e17e5567e08148550a7f1d94d495b9fb17", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mops: Do not dereference src reg for a set operation\n\nThe source register is not used for SET* and reading it can result in\na UBSAN out-of-bounds array access error, specifically when the MOPS\nexception is taken from a SET* sequence with XZR (reg 31) as the\nsource. Architecturally this is the only case where a src/dst/size\nfield in the ESR can be reported as 31.\n\nPrior to 2de451a329cf662b the code in do_el0_mops() was benign as the\nuse of pt_regs_read_reg() prevented the out-of-bounds access."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: mops: No desreferenciar el registro src para una operaci\u00f3n set. El registro fuente no se utiliza para SET* y leerlo puede resultar en un error de acceso a la matriz UBSAN fuera de los l\u00edmites, espec\u00edficamente cuando la excepci\u00f3n MOPS se toma de una secuencia SET* con XZR (reg 31) como origen. Arquitect\u00f3nicamente, este es el \u00fanico caso donde un campo src/dst/size en el ESR puede reportarse como 31. Antes de 2de451a329cf662b, el c\u00f3digo en do_el0_mops() era benigno ya que el uso de pt_regs_read_reg() imped\u00eda el acceso fuera de los l\u00edmites."}], "lastModified": "2025-05-12T17:32:52.810", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}