CVE-2025-21928

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21928
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `driver_data` directly within the loop that destroys the HID devices, which can lead to accessing freed memory. Specifically, `hid_destroy_device()` uses `driver_data` when it calls `hid_ishtp_set_feature()` to power off the sensor, so freeing `driver_data` beforehand can result in accessing invalid memory. This patch resolves the issue by storing the `driver_data` in a temporary variable before calling `hid_destroy_device()`, and then freeing the `driver_data` after the device is destroyed.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/01b18a330cda61cc21423a7d1af92cf31ded8f60 Patch
https://git.kernel.org/stable/c/07583a0010696a17fb0942e0b499a62785c5fc9f Patch
https://git.kernel.org/stable/c/0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d Patch
https://git.kernel.org/stable/c/560f4d1299342504a6ab8a47f575b5e6b8345ada Patch
https://git.kernel.org/stable/c/cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394 Patch
https://git.kernel.org/stable/c/d3faae7f42181865c799d88c5054176f38ae4625 Patch
https://git.kernel.org/stable/c/dea6a349bcaf243fff95dfd0428a26be6a0fb44e Patch
https://git.kernel.org/stable/c/eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
History

11 Apr 2025, 13:11

Type Values Removed Values Added
CWE CWE-416
References () https://git.kernel.org/stable/c/01b18a330cda61cc21423a7d1af92cf31ded8f60 - () https://git.kernel.org/stable/c/01b18a330cda61cc21423a7d1af92cf31ded8f60 - Patch
References () https://git.kernel.org/stable/c/07583a0010696a17fb0942e0b499a62785c5fc9f - () https://git.kernel.org/stable/c/07583a0010696a17fb0942e0b499a62785c5fc9f - Patch
References () https://git.kernel.org/stable/c/0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d - () https://git.kernel.org/stable/c/0c1fb475ef999d6c22fc3f963fdf20cb3ed1b03d - Patch
References () https://git.kernel.org/stable/c/560f4d1299342504a6ab8a47f575b5e6b8345ada - () https://git.kernel.org/stable/c/560f4d1299342504a6ab8a47f575b5e6b8345ada - Patch
References () https://git.kernel.org/stable/c/cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394 - () https://git.kernel.org/stable/c/cf1a6015d2f6b1f0afaa0fd6a0124ff2c7943394 - Patch
References () https://git.kernel.org/stable/c/d3faae7f42181865c799d88c5054176f38ae4625 - () https://git.kernel.org/stable/c/d3faae7f42181865c799d88c5054176f38ae4625 - Patch
References () https://git.kernel.org/stable/c/dea6a349bcaf243fff95dfd0428a26be6a0fb44e - () https://git.kernel.org/stable/c/dea6a349bcaf243fff95dfd0428a26be6a0fb44e - Patch
References () https://git.kernel.org/stable/c/eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9 - () https://git.kernel.org/stable/c/eb0695d87a81e7c1f0509b7d8ee7c65fbc26aec9 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: intel-ish-hid: soluciona el problema de use-after-free en ishtp_hid_remove() El sistema puede experimentar un bloqueo aleatorio unos minutos después de eliminar el controlador. Este problema se produce debido a la gestión incorrecta de la liberación de memoria en la función ishtp_hid_remove(). La función actualmente libera `driver_data` directamente dentro del bucle que destruye los dispositivos HID, lo que puede llevar al acceso a la memoria liberada. Específicamente, `hid_destroy_device()` usa `driver_data` cuando llama a `hid_ishtp_set_feature()` para apagar el sensor, por lo que liberar `driver_data` de antemano puede resultar en el acceso a memoria no válida. Este parche resuelve el problema almacenando `driver_data` en una variable temporal antes de llamar a `hid_destroy_device()` y luego liberando `driver_data` después de que se destruye el dispositivo.
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux

01 Apr 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 16:15

Updated : 2025-04-16 14:15

NVD link : CVE-2025-21928

Mitre link : CVE-2025-21928

CVE.ORG link : CVE-2025-21928

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free