CVE - CVE-2025-21738

CVE-ID
CVE-2025-21738	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory. While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug. Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer. Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/0a17a9944b8d89ef03946121241870ac53ddaf45 URL:https://git.kernel.org/stable/c/0a17a9944b8d89ef03946121241870ac53ddaf45 MISC:https://git.kernel.org/stable/c/0dd5aade301a10f4b329fa7454fdcc2518741902 URL:https://git.kernel.org/stable/c/0dd5aade301a10f4b329fa7454fdcc2518741902 MISC:https://git.kernel.org/stable/c/6e74e53b34b6dec5a50e1404e2680852ec6768d2 URL:https://git.kernel.org/stable/c/6e74e53b34b6dec5a50e1404e2680852ec6768d2 MISC:https://git.kernel.org/stable/c/a8f8cf87059ed1905c2a5c72f8b39a4f57b11b4c URL:https://git.kernel.org/stable/c/a8f8cf87059ed1905c2a5c72f8b39a4f57b11b4c MISC:https://git.kernel.org/stable/c/d5e6e3000309359eae2a17117aa6e3c44897bf6c URL:https://git.kernel.org/stable/c/d5e6e3000309359eae2a17117aa6e3c44897bf6c
Assigning CNA
kernel.org
Date Record Created
20241229	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241229)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)