CVE-2025-38183

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()

Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value

is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8).

This seems correct and aligns with the PTP interrupt status register

(PTP_INT_STS) specifications.

However, lan743x_ptp_io_event_clock_get() writes to ptp->extts[] with

only LAN743X_PTP_N_EXTTS(4) elements, using channel as an index:

lan743x_ptp_io_event_clock_get(..., u8 channel,...)

{

...

/* Update Local timestamp */

extts = &ptp->extts[channel];

extts->ts.tv_sec = sec;

...

}

To avoid an out-of-bounds write and utilize all the supported GPIO

inputs, set LAN743X_PTP_N_EXTTS to 8.

Detected using the static analysis tool - Svace.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References