CVE-2025-38183

What it actually does

Out-of-bounds write in lan743x_ptp_io_event_clock_get() when channel index exceeds the 4-element extts array size despite checks allowing up to 8 channels.

Why it matters to the business

Memory corruption on affected Linux systems can lead to crashes, data corruption, or potential code execution in kernel context, disrupting network operations and requiring urgent patching across deployments.

How an attack unfolds

An attacker with local access or the ability to trigger PTP events on a lan743x device supplies a channel value between 4 and 7, causing the function to write timestamps beyond the allocated extts array and corrupt adjacent kernel memory.

How to fix it

Update to Linux kernel commit e8d48201a132f4aab31351c19a802c5a5ae820fa or later; for thanos-operator-fips and thanos-operator-fips-compat upgrade to 0.3.7-r30 or newer. Rebuild and redeploy any custom kernels containing the lan743x driver.

How to confirm the fix worked

Confirm the LAN743X_PTP_N_EXTTS definition is set to 8 and that lan743x_ptp_io_event_clock_get() bounds checks align with the full supported channel range; test PTP event handling on hardware with more than four GPIO inputs.

Typical attack path

1. Gain local access or control a process that can interact with the lan743x PTP interface
2. Trigger PTP I/O events with channel values exceeding LAN743X_PTP_N_EXTTS
3. Overwrite kernel memory via the out-of-bounds write to extts[]
4. Escalate to denial of service or attempt further exploitation of corrupted state

How to detect it

Review kernel logs for oops or panic messages involving lan743x_ptp_io_event_clock_get or extts array accesses; inspect for unexpected PTP timestamp writes or memory corruption symptoms on systems with lan743x hardware.

What your security team should do

• Prioritize kernel updates on all systems using the lan743x driver within the next maintenance window
• Monitor for related Linux kernel memory corruption issues and apply fixes promptly
• Restrict unprivileged access to PTP interfaces where possible until patched