CVE-2025-68352 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
spi: ch341: fix out-of-bounds memory access in ch341_transfer_one
Discovered by Atuin - Automated Vulnerability Discovery Engine.
The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header.
When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len' as the length is incorrect because:
1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size 'trans->len', i.e., 'len - 1' in this context). 2. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1 overflows the buffer.
Fix this by copying 'len - 1' bytes.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/28/2025
The vulnerability CVE-2025-68352 represents a critical out-of-bounds memory access flaw within the Linux kernel's SPI driver for the ch341 device. This issue resides in the ch341_transfer_one function where improper buffer handling creates conditions for both read and write memory corruption. The vulnerability was identified through automated discovery mechanisms, highlighting the ongoing need for systematic security analysis of kernel components. The ch341 driver is commonly used for USB-to-SPI bridge functionality, making this flaw potentially exploitable in systems relying on such hardware interfaces. The flaw specifically impacts the communication protocol between USB devices and SPI peripherals through the ch341 bridge controller.
The technical implementation of this vulnerability stems from incorrect buffer length calculations during data transfer operations. The system calculates a 'len' variable as the minimum of 32 and 'trans->len + 1', where the '+1' accounts for a 1-byte command header. However, this calculation fails to properly account for the actual data buffer boundaries when performing memory operations. When copying data from the transmission buffer 'trans->tx_buf' to the ch341 transmit buffer 'ch341->tx_buf + 1', the code uses the incorrect 'len' value instead of the proper 'len - 1' calculation. This fundamental miscalculation creates two distinct memory corruption scenarios that can be exploited by malicious actors. The first scenario involves out-of-bounds read operations from the source buffer, while the second creates out-of-bounds write conditions that can overwrite adjacent memory locations.
The operational impact of this vulnerability extends beyond simple memory corruption, potentially enabling privilege escalation and system instability. When 'len' equals CH341_PACKET_LENGTH (32), the buffer overflow condition becomes particularly severe as it can overwrite critical memory segments within the driver's operational context. This type of memory corruption can lead to denial of service conditions, data corruption, or even arbitrary code execution depending on the exploitation vector. The vulnerability affects systems using the ch341 USB-to-SPI bridge controller, which are commonly found in embedded systems, IoT devices, and industrial control environments where SPI communication is essential for device operation. The flaw demonstrates how seemingly minor buffer length calculations can create significant security risks in kernel-level drivers, particularly those handling device communication protocols.
Mitigation strategies for CVE-2025-68352 require immediate kernel updates that implement the fix for the buffer length calculation error. The recommended approach involves changing the data copy operation from using 'len' to 'len - 1' bytes to ensure proper boundary checking. This fix aligns with standard secure coding practices and addresses the root cause of the memory access violation. System administrators should prioritize patching affected kernel versions, particularly those running on embedded systems and IoT devices that utilize ch341 USB-to-SPI bridges. Additionally, monitoring for suspicious memory access patterns and implementing proper input validation for device communication protocols can help detect potential exploitation attempts. The vulnerability classification aligns with CWE-129 and CWE-787, representing issues related to insufficient input validation and out-of-bounds writes respectively. This flaw also maps to ATT&CK technique T1068, which covers 'Exploitation for Privilege Escalation', as the memory corruption could potentially be leveraged to gain elevated system privileges. Organizations should conduct comprehensive vulnerability assessments of their embedded systems to identify other potentially affected drivers or components that might exhibit similar buffer handling issues.