CVE-2025-22003
can: ucan: fix out of bound read in strscpy() source
Published Apr 3, 2025
CVSS 3.1 · 5.5 Medium
EPSS < 1%
KEV · Not listed
Description
In the Linux kernel, the following vulnerability has been resolved:
can: ucan: fix out of bound read in strscpy() source
Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()")
unintentionally introduced a one byte out of bound read on strscpy()'s
source argument (which is kind of ironic knowing that strscpy() is meant
to be a more secure alternative :)).
Let's consider below buffers:
dest[len + 1]; /* will be NUL terminated */
src[len]; /* may not be NUL terminated */
When doing:
strncpy(dest, src, len);
dest[len] = '\0';
strncpy() will read up to len bytes from src.
On the other hand:
strscpy(dest, src, len + 1);
will read up to len + 1 bytes from src, that is to say, an out of bound
read of one byte will occur on src if it is not NUL terminated. Note
that the src[len] byte is never copied, but strscpy() still needs to
read it to check whether a truncation occurred or not.
This exact pattern happened in ucan.
The root cause is that the source is not NUL terminated. Instead of
doing a copy in a local buffer, directly NUL terminate it as soon as
usb_control_msg() returns. With this, the local firmware_str[] variable
can be removed.
On top of this do a couple refactors:
- ucan_ctl_payload->raw is only used for the firmware string, so
rename it to ucan_ctl_payload->fw_str and change its type from u8 to
char.
- ucan_device_request_in() is only used to retrieve the firmware
string, so rename it to ucan_get_fw_str() and refactor it to make it
directly handle all the string termination logic.
can: ucan: fix out of bound read in strscpy() source
Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()")
unintentionally introduced a one byte out of bound read on strscpy()'s
source argument (which is kind of ironic knowing that strscpy() is meant
to be a more secure alternative :)).
Let's consider below buffers:
dest[len + 1]; /* will be NUL terminated */
src[len]; /* may not be NUL terminated */
When doing:
strncpy(dest, src, len);
dest[len] = '\0';
strncpy() will read up to len bytes from src.
On the other hand:
strscpy(dest, src, len + 1);
will read up to len + 1 bytes from src, that is to say, an out of bound
read of one byte will occur on src if it is not NUL terminated. Note
that the src[len] byte is never copied, but strscpy() still needs to
read it to check whether a truncation occurred or not.
This exact pattern happened in ucan.
The root cause is that the source is not NUL terminated. Instead of
doing a copy in a local buffer, directly NUL terminate it as soon as
usb_control_msg() returns. With this, the local firmware_str[] variable
can be removed.
On top of this do a couple refactors:
- ucan_ctl_payload->raw is only used for the firmware string, so
rename it to ucan_ctl_payload->fw_str and change its type from u8 to
char.
- ucan_device_request_in() is only used to retrieve the firmware
string, so rename it to ucan_get_fw_str() and refactor it to make it
directly handle all the string termination logic.
Analysis
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
|||||||||||||||||||||
| Linux | Linux | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-9600 | In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix out of bound read in strscpy() source Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()") unintentionally introduced a one byte out of bound read on strscpy()'s source argument (which is kind of ironic knowing that strscpy() is meant to be a more secure alternative :)). Let's consider below buffers: dest[len + 1]; /* will be NUL terminated */ src[len]; /* may not be NUL terminated */ When doing: strncpy(dest, src, len); dest[len] = '\0'; strncpy() will read up to len bytes from src. On the other hand: strscpy(dest, src, len + 1); will read up to len + 1 bytes from src, that is to say, an out of bound read of one byte will occur on src if it is not NUL terminated. Note that the src[len] byte is never copied, but strscpy() still needs to read it to check whether a truncation occurred or not. This exact pattern happened in ucan. The root cause is that the source is not NUL terminated. Instead of doing a copy in a local buffer, directly NUL terminate it as soon as usb_control_msg() returns. With this, the local firmware_str[] variable can be removed. On top of this do a couple refactors: - ucan_ctl_payload->raw is only used for the firmware string, so rename it to ucan_ctl_payload->fw_str and change its type from u8 to char. - ucan_device_request_in() is only used to retrieve the firmware string, so rename it to ucan_get_fw_str() and refactor it to make it directly handle all the string termination logic. |
 Ubuntu USN |
USN-7605-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7605-2 | Linux kernel (Low Latency) vulnerabilities |
| Ubuntu USN |
USN-7606-1 | Linux kernel (OEM) vulnerabilities |
| Ubuntu USN |
USN-7628-1 | Linux kernel (Azure) vulnerabilities |
| Ubuntu USN |
USN-7764-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7764-2 | Linux kernel (HWE) vulnerabilities |
| Ubuntu USN |
USN-7765-1 | Linux kernel (NVIDIA) vulnerabilities |
| Ubuntu USN |
USN-7766-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7767-1 | Linux kernel (Real-time) vulnerabilities |
| Ubuntu USN |
USN-7767-2 | Linux kernel (Real-time) vulnerabilities |
| Ubuntu USN |
USN-7779-1 | Linux kernel (IBM) vulnerabilities |
| Ubuntu USN |
USN-7790-1 | Linux kernel (Raspberry Pi) vulnerabilities |
| Ubuntu USN |
USN-7800-1 | Linux kernel (Raspberry Pi Real-time) vulnerabilities |
| Ubuntu USN |
USN-7801-1 | Linux kernel (HWE) vulnerabilities |
| Ubuntu USN |
USN-7802-1 | Linux kernel (Azure) vulnerabilities |
| Ubuntu USN |
USN-7801-2 | Linux kernel (Oracle) vulnerabilities |
| Ubuntu USN |
USN-7809-1 | Linux kernel (Azure, N-Series) vulnerabilities |
| Ubuntu USN |
USN-7801-3 | Linux kernel (Oracle) vulnerabilities |
Metrics
No CVSS v4.0
Attack Vector Local
Attack Complexity Low
Privileges Required Low
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.216% probability within 30 days)
Exploitation none
Automatable no
Technical Impact partial
References
History
Oct 1, 2025 5:15 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Apr 12, 2025 3:00 AM
Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Apr 10, 2025 4:30 PM
First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | CWE-125 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:* |
|
| Vendors & Products |
Linux
Linux linux Kernel |
|
| Metrics |
cvssV3_1
|
Apr 4, 2025 2:15 AM
Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Apr 3, 2025 7:30 AM
Description updated. Title updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix out of bound read in strscpy() source Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()") unintentionally introduced a one byte out of bound read on strscpy()'s source argument (which is kind of ironic knowing that strscpy() is meant to be a more secure alternative :)). Let's consider below buffers: dest[len + 1]; /* will be NUL terminated */ src[len]; /* may not be NUL terminated */ When doing: strncpy(dest, src, len); dest[len] = '\0'; strncpy() will read up to len bytes from src. On the other hand: strscpy(dest, src, len + 1); will read up to len + 1 bytes from src, that is to say, an out of bound read of one byte will occur on src if it is not NUL terminated. Note that the src[len] byte is never copied, but strscpy() still needs to read it to check whether a truncation occurred or not. This exact pattern happened in ucan. The root cause is that the source is not NUL terminated. Instead of doing a copy in a local buffer, directly NUL terminate it as soon as usb_control_msg() returns. With this, the local firmware_str[] variable can be removed. On top of this do a couple refactors: - ucan_ctl_payload->raw is only used for the firmware string, so rename it to ucan_ctl_payload->fw_str and change its type from u8 to char. - ucan_device_request_in() is only used to retrieve the firmware string, so rename it to ucan_get_fw_str() and refactor it to make it directly handle all the string termination logic. | |
| Title | can: ucan: fix out of bound read in strscpy() source | |
| References |
|
Subscriptions
Weaknesses
-
CWE-125
Out-of-bounds Read
