CVE-2025-21804
Description
From CVE.org
In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior. Depending on the current contents of the memory, the manifestations of errors may vary. One possible output may be as follows: $ cat /proc/iomem 30000000-37ffffff : 38000000-3fffffff : Sometimes, garbage may appear after the colon. In very rare cases, if no NULL-terminator is found in memory, the system might crash because the string iterator will overrun which can lead to access of unmapped memory above the stack. Thus, fix this by replacing outbound_name with the name of the previously requested resource. With the changes applied, the output will be as follows: $ cat /proc/iomem 30000000-37ffffff : memory2 38000000-3fffffff : memory3 [kwilczynski: commit log]
Statement
This flaw, rated low severity by Red Hat Product Security, affects the Renesas R-Car PCIe endpoint driver in the Linux kernel. In rcar_pcie_parse_outbound_ranges(), a dynamically computed resource name stored in a stack buffer is passed to the devm_request_mem_region() macro, which can lead to undefined behavior. Depending on the current contents of memory, the resource names reported in /proc/iomem may be empty or contain garbage, and in very rare cases, if no NULL-terminator is found in memory, the string iterator can overrun the stack buffer and access unmapped memory above the stack, causing a system crash. The issue is limited to systems using the R-Car PCIe endpoint driver on Renesas R-Car SoC hardware, and Red Hat's CVSS assessment (3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) reflects a local attack vector with low availability impact only. Red Hat's low rating is lower than the NIST score of 5.5 (moderate) and the CVE.org score of 7.1 (important). All Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams in this record are currently recorded as not affected; for Red Hat In-Vehicle OS, the recorded justification is that the vulnerable code is not present.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | 5.5 | 7.1 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | None | None | None |
| Availability Impact | Low | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
