CVE-2025-37891

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37891
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix buffer overflow at UMP SysEx message conversion The conversion function from MIDI 1.0 to UMP packet contains an internal buffer to keep the incoming MIDI bytes, and its size is 4, as it was supposed to be the max size for a MIDI1 UMP packet data. However, the implementation overlooked that SysEx is handled in a different format, and it can be up to 6 bytes, as found in do_convert_to_ump(). It leads eventually to a buffer overflow, and may corrupt the memory when a longer SysEx message is received. The fix is simply to extend the buffer size to 6 to fit with the SysEx UMP message.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/226beac5605afbb33f8782148d188b64396145a4 Patch
https://git.kernel.org/stable/c/42ef48dd4ebb082a1a90b5c3feeda2e68a9e32fe Patch
https://git.kernel.org/stable/c/56f1f30e6795b890463d9b20b11e576adf5a2f77 Patch
https://git.kernel.org/stable/c/ce4f77bef276e7d2eb7ab03a5d08bcbaa40710ec Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
History

17 Nov 2025, 19:21

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CWE CWE-120
References () https://git.kernel.org/stable/c/226beac5605afbb33f8782148d188b64396145a4 - () https://git.kernel.org/stable/c/226beac5605afbb33f8782148d188b64396145a4 - Patch
References () https://git.kernel.org/stable/c/42ef48dd4ebb082a1a90b5c3feeda2e68a9e32fe - () https://git.kernel.org/stable/c/42ef48dd4ebb082a1a90b5c3feeda2e68a9e32fe - Patch
References () https://git.kernel.org/stable/c/56f1f30e6795b890463d9b20b11e576adf5a2f77 - () https://git.kernel.org/stable/c/56f1f30e6795b890463d9b20b11e576adf5a2f77 - Patch
References () https://git.kernel.org/stable/c/ce4f77bef276e7d2eb7ab03a5d08bcbaa40710ec - () https://git.kernel.org/stable/c/ce4f77bef276e7d2eb7ab03a5d08bcbaa40710ec - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: ump: Se corrige el desbordamiento del búfer en la conversión de mensajes SysEx de UMP. La función de conversión de paquetes MIDI 1.0 a UMP contiene un búfer interno para almacenar los bytes MIDI entrantes, y su tamaño es de 4, ya que se suponía que era el tamaño máximo para los datos de un paquete MIDI1 UMP. Sin embargo, la implementación pasó por alto que SysEx se maneja en un formato diferente, y puede tener hasta 6 bytes, como se encuentra en do_convert_to_ump(). Eventualmente conduce a un desbordamiento del búfer y puede dañar la memoria cuando se recibe un mensaje SysEx más largo. La solución es simplemente extender el tamaño del búfer a 6 para que se ajuste al mensaje SysEx UMP.

19 May 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-19 08:15

Updated : 2025-11-17 19:21

NVD link : CVE-2025-37891

Mitre link : CVE-2025-37891

CVE.ORG link : CVE-2025-37891

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')