CVE-2025-38487

What it actually does

The flaw triggers a kernel NULL pointer dereference in aspeed_lpc_snoop_remove when a platform driver unbind is performed on channels that were never enabled, resulting in an Oops during misc_deregister.

Why it matters to the business

Systems using the affected ASPEED LPC snoop driver can experience unexpected kernel crashes that interrupt operations and require reboots, with elevated urgency due to listed threat actor activity around similar kernel privilege issues and high downstream package prevalence.

How an attack unfolds

An attacker with local access writes the driver name to the unbind sysfs entry, causing the remove path to dereference an uninitialized channel pointer and crash the kernel; named actors associated with Linux kernel privilege-escalation campaigns may chain this with other flaws.

How to fix it

Upgrade to the listed fixed package versions: thunderbird 1:128.13.0esr-1~deb11u1 (Debian 11), 1:128.13.0esr-1~deb12u1 (Debian 12), 1:128.13.0esr-1 (Debian 13); firefox-esr 128.13.0esr-1~deb11u1 (Debian 11), 128.13.0esr-1~deb12u1 (Debian 12), 128.13.0esr-1 (Debian 13). Apply kernel patches that add the enabled-channel guard before removal.

How to confirm the fix worked

Confirm the updated packages are installed, then attempt the unbind operation in a test environment and verify the driver remove path no longer dereferences NULL; inspect kernel logs for absence of the prior Oops signature.

Typical attack path

1. Locate a system exposing the aspeed-lpc-snoop platform driver
2. Write the device name to /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind
3. Trigger the remove handler that skips the enabled-channel check
4. Cause NULL pointer dereference and kernel panic

How to detect it

Review kernel logs for Oops messages referencing aspeed_lpc_snoop_remove and misc_deregister around the time of driver unbind attempts; correlate with sysfs writes to the aspeed-lpc-snoop unbind path and any activity from the named advanced spyware or privilege-escalation campaigns.

• aspeed_lpc_snoop_remove+0x84/0xac
• Unable to handle kernel NULL pointer dereference at virtual address 00000004 when write
• echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind

What your security team should do

• Prioritize patching the listed Debian packages within the CISA-style remediation window given the 456 days since publication and rising EPSS trend
• Restrict unprivileged access to platform driver sysfs bind/unbind files
• Monitor for similar channel-enable checks in other ASPEED LPC drivers
• Harden systems against local driver manipulation used by the listed threat actors