ASPEED LPC snoop driver (drivers/soc/aspeed/aspeed-lpc-snoop.c): Under memory pressure an allocation in the LPC snoop

CVSS 5.5CVE-2025-38145Firmware, BMC & network fabriccurated

Impact

Under memory pressure an allocation in the LPC snoop setup path returns NULL and is dereferenced, oopsing the BMC kernel. LPC snoop is the channel that captures host POST codes and BIOS progress, so the practical loss is the BMC panicking during host boot - exactly the window where an operator is watching POST codes to diagnose a node that will not come up. Availability only, but on a large fleet the BMC dropping out mid-boot means losing remote power control on a node you now have to touch physically.

Who can reach it

Local on the BMC, and needs the BMC to be under memory pressure when the snoop channel is enabled. Practically this surfaces as a reliability bug rather than something an external attacker drives, though anything that inflates BMC memory usage (a pre-auth bmcweb allocation bug, for example) raises the odds.

What to do

Kernel one-liner, backported to stable. Reaches nodes only via a BMC firmware image update: per-node, out-of-band, ODM-rebase dependent. No config workaround worth the tradeoff - disabling LPC snoop costs you host POST-code visibility, which is one of the main reasons the BMC is there. Low enough severity that batching it into your next scheduled firmware refresh is the right call.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-38145 https://git.kernel.org/stable/c/c550999f939b529d28a914d5034cc4290066aea6

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.