CVE-2025-38585

What it actually does

Stack buffer overflow in gmin_get_var_int() caused by gmin_get_config_var() returning stale error codes instead of EFI failure status, allowing val[len]=0 write beyond the 65-byte stack allocation when efi.get_variable() reports EFI_BUFFER_TOO_SMALL for variables larger than 64 bytes.

Why it matters to the business

Local attackers on affected Intel Bay Trail and Cherry Trail systems can achieve privilege escalation or denial of service during camera sensor initialization; low prevalence but requires urgent patching on embedded and IoT devices using the atomisp stack.

How an attack unfolds

An attacker with local access crafts oversized EFI variables that trigger the flawed error path in gmin_get_config_var during device probe; the kernel then writes past the end of the stack buffer, enabling code execution or crashes on platforms using the atomisp driver.

How to fix it

Apply the upstream fix in commit 3d672fe065aa00f4d66f42e3c9720f69a3ed43e7; update affected packages to openjdk-11-openj9 0.53.0-r0 or later where the atomisp driver is present; rebuild and reboot with patched kernel.

How to confirm the fix worked

Verify kernel contains commit 3d672fe065aa00f4d66f42e3c9720f69a3ed43e7; confirm gmin_get_config_var properly propagates EFI errors; test initialization with oversized EFI variables to ensure no overflow occurs.

Typical attack path

1. Obtain local access or container escape on target system
2. Manipulate EFI variables to exceed 64 bytes
3. Trigger atomisp camera initialization
4. Exploit stale return value to perform out-of-bounds stack write
5. Escalate privileges or crash the kernel

How to detect it

Inspect dmesg and kernel logs for atomisp initialization failures or stack overflow warnings around gmin_get_var_int; correlate with EFI variable access events during device probe on Intel platforms.

• gmin_get_var_int
• gmin_get_config_var
• EFI_BUFFER_TOO_SMALL
• atomisp camera sensor configuration

What your security team should do

• Patch kernels on all Bay Trail and Cherry Trail systems within 30 days
• Disable atomisp driver via kernel config if camera functionality is unused
• Monitor local privilege-escalation attempts targeting media subsystems
• Audit EFI variable sizes during boot on affected hardware