CVE-2025-38173

What it actually does

The flaw in the Marvell CESA crypto driver allows reading from arbitrary kernel memory locations when a zero-length skcipher request is processed instead of safely returning without memory access.

Why it matters to the business

Systems using affected Linux kernel versions with Marvell crypto hardware may experience crashes or unintended memory disclosure, increasing risk of data exposure or service disruption especially in high-volume crypto workloads.

How an attack unfolds

An attacker with local access or the ability to trigger crypto operations submits a zero-length skcipher request to the Marvell CESA driver, causing the kernel to read from uninitialized or random memory addresses; this can be leveraged for information leaks or to aid further privilege escalation in combination with other kernel flaws.

How to fix it

Update the Linux kernel to a version containing commit 32d3e8049a8b60f18c5c39f5931bfb1130ac11c9 or later; rebuild and deploy the updated kernel image on all affected systems; disable the marvell/cesa driver if hardware crypto acceleration is not required.

How to confirm the fix worked

Verify the running kernel contains commit 32d3e8049a8b60f18c5c39f5931bfb1130ac11c9 via git log or package version checks; test zero-length skcipher requests against the driver to confirm they now return cleanly without memory access attempts.

Typical attack path

1. Identify systems exposing Marvell CESA crypto interfaces or allowing local crypto request submission
2. Craft and submit a zero-length skcipher request via the kernel crypto API
3. Observe resulting memory contents or kernel panic to confirm and exploit the out-of-bounds read
4. Combine leaked data or crash state with other techniques for privilege escalation or persistence

How to detect it

Search kernel logs and audit trails for skcipher request handling errors or memory faults originating from the marvell/cesa module; look for unexpected zero-length crypto operations or related oops/panic traces in dmesg and syslog.

What your security team should do

• Prioritize kernel upgrades on all systems using Marvell CESA hardware within the next patching cycle
• Audit crypto driver configurations and disable unused acceleration modules where possible
• Monitor kernel logs for unusual skcipher request patterns or memory faults related to the cesa driver
• Review downstream dependent packages and rebuild images incorporating the fixed kernel commit