Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

CVE-2025-71197

w1: therm: Fix off-by-one buffer overflow in alarms_store

Not available

At a glance

Source
NVD
EPSS
EPSS 0.25 % · percentile 17 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Deferred

Description

In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'. Fix this by parsing the 'buf' parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code.

References

European references

CERT-FR advisories

Affected products

ProductVersions
Linux · Linuxaffected e2c94d6f572079511945e64537eb1218643f2e68 < 49ff9b4b9deacbefa6654a0a2bcaf910c9de7e95 ; affected e2c94d6f572079511945e64537eb1218643f2e68 < 060b08d72a38b158a7f850d4b83c17c2969e0f6b ; affected e2c94d6f572079511945e64537eb1218643f2e68 < b3fc3e1f04dcc7c41787bbf08a6e0d2728e022cf ; affected e2c94d6f572079511945e64537eb1218643f2e68 < 6a5820ecfa5a76c3d3e154802c8c15f391ef442e ; affected e2c94d6f572079511945e64537eb1218643f2e68 < 6fd6d2a8e41b7f544a4d26cbd60bedf9c67893a0 ; affected e2c94d6f572079511945e64537eb1218643f2e68 < e6b2609af21b5cccc9559339591b8a2cbf884169
Linux · Linuxaffected 5.8 ; unaffected 0 < 5.8 ; unaffected 5.10.249 ≤ 5.10.* ; unaffected 5.15.199 ≤ 5.15.* ; unaffected 6.1.162 ≤ 6.1.* ; unaffected 6.6.122 ≤ 6.6.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD