Listen to this Post
How the CVE Works
The vulnerability occurs in the Linux kernel’s `tracing/osnoise` subsystem. When a user writes to the `/sys/kernel/debug/tracing/osnoise/cpus` file with a buffer length (count) of zero, the `osnoise_cpus_write()` function calls `kmalloc()` with a size of zero. In the Linux kernel, `kmalloc(0)` returns a special pointer value called `ZERO_SIZE_PTR` (which has the address 0x10), not a traditional `NULL` pointer. This `ZERO_SIZE_PTR` is then passed to `cpulist_parse()` function. The `cpulist_parse()` function internally calls `bitmap_parselist()` without properly checking for this special pointer. The `bitmap_parselist()` function attempts to dereference the pointer, mistaking it for a valid memory address. Since `ZERO_SIZE_PTR` points to an invalid, non-allocated memory location (address 0x10), this causes a null pointer dereference. The kernel attempts to read from address 0x0000000000000010, leading to a system crash (kernel oops) and a denial of service. The issue is specifically triggered by a write operation with zero length, such as write(fd, "0-2", 0);, where the data string is irrelevant because the count is zero.
DailyCVE Form
Platform: Linux Kernel
Version: Up to 6.17.0-rc4
Vulnerability: Null Pointer Dereference
Severity: Medium
date: 2025-09-23
Prediction: 2025-09-23
What Undercode Say:
Analytics
Command to trigger the vulnerability echo -n "0-2" | sudo tee /sys/kernel/debug/tracing/osnoise/cpus Alternative method using write() sudo bash -c 'exec 3<>/sys/kernel/debug/tracing/osnoise/cpus; echo -n "1" >&3' Check kernel log for Oops message sudo dmesg | tail -20 Verify running kernel version uname -r
How Exploit:
1. Gain local access to target system.
2. Check if `/sys/kernel/debug/tracing/osnoise/cpus` exists.
- Execute a write operation with zero count to the file.
4. Trigger kernel oops and potential system instability.
Protection from this CVE
Update Linux Kernel
Apply official patch
Disable osnoise tracer
Impact:
Kernel panic crash
Local Denial-of-Service
System instability
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
