Detections
Analytics

Echo: linux: security update to 6.1.147-1

high Tenable Self-Hosted Container Security Plugin ID 462810

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: wifi: p54: prevent buffer-overflow in
 p54_rx_eeprom_readback() Robert Morris reported: |If a malicious USB device pretends to be an Intersil p54
 wifi |interface and generates an eeprom_readback message with a large |eeprom->v1.len,
 p54_rx_eeprom_readback() will copy data from the |message beyond the end of priv->eeprom. | |static void
 p54_rx_eeprom_readback(struct p54_common *priv, | struct sk_buff *skb) |{ | struct p54_hdr *hdr = (struct
 p54_hdr *) skb->data; | struct p54_eeprom_lm86 *eeprom = (struct p54_eeprom_lm86 *) hdr->data; | | if
 (priv->fw_var >= 0x509) { | memcpy(priv->eeprom, eeprom->v2.data, | le16_to_cpu(eeprom->v2.len)); | } else
 { | memcpy(priv->eeprom, eeprom->v1.data, | le16_to_cpu(eeprom->v1.len)); | } | [...] The
 eeprom->v{1,2}.len is set by the driver in p54_download_eeprom(). The device is supposed to provide the
 same length back to the driver. But yes, it's possible (like shown in the report) to alter the value to
 something that causes a crash/panic due to overrun. This patch addresses the issue by adding the size to
 the common device context, so p54_rx_eeprom_readback no longer relies on possibly tampered values... That
 said, it also checks if the "firmware" altered the value and no longer copies them. The one, small saving
 grace is: Before the driver tries to read the eeprom, it needs to upload >a< firmware. the vendor firmware
 has a proprietary license and as a reason, it is not present on most distributions by default.
 (CVE-2025-38348)

Solution

Update the linux library and its related packages to version 6.1.147-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-38348

Plugin Details

Severity: High

ID: 462810

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.38

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-38348

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 7/10/2025

Reference Information

CVE: CVE-2025-38348