ata: libata-sff: Ensure that we cannot write outside the allocated buffer 漏洞信息(CVE-2025-21738)

一、漏洞 CVE-2025-21738 基础信息

AIGC 神龙大模型
美国国家漏洞数据库 NVD

漏洞标题

ATA: libata-sff: 确保不会写入超出已分配的缓冲区

来源：AIGC 神龙大模型

漏洞描述信息

在Linux内核中，已修复以下漏洞： ata: libata-sff: 确保无法写入分配缓冲区之外的内存 reveliofuzzing报告称，通过将SCSI_IOCTL_SEND_COMMAND ioctl的out_len设置为0xd42，SCSI命令设置为ATA_16 透传，ATA命令设置为ATA_NOP，协议设置为ATA_PROT_PIO，可以使ata_pio_sector()写入分配缓冲区之外的内存，从而覆盖随机内存。虽然ATA设备应该终止ATA_NOP命令，但看起来在libata-sff或QEMU中存在一个bug，导致该状态未设置，或该状态在ata_sff_hsm_move()读取之前被清除。无论如何，这很可能是一个单独的bug。在__atapi_pio_bytes()中，已经有一个安全检查，以确保__atapi_pio_bytes()不会写入分配缓冲区之外的内存。在ata_pio_sector()中添加类似的检查，以确保ata_pio_sector()也不会写入分配缓冲区之外的内存。

来源：AIGC 神龙大模型

CVSS信息

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

来源：AIGC 神龙大模型

漏洞类别

跨界内存写

来源：AIGC 神龙大模型

漏洞标题

ata: libata-sff: Ensure that we cannot write outside the allocated buffer

来源：美国国家漏洞数据库 NVD

漏洞描述信息

In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory. While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug. Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer. Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer.

来源：美国国家漏洞数据库 NVD

CVSS信息

N/A

来源：美国国家漏洞数据库 NVD

漏洞类别

N/A

来源：美国国家漏洞数据库 NVD

二、漏洞 CVE-2025-21738 的公开POC

#	POC 描述	源链接	神龙链接

三、漏洞 CVE-2025-21738 的情报信息

标题： ata: libata-sff: Ensure that we cannot write outside the allocated buffer - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： ata: libata-sff: Ensure that we cannot write outside the allocated buffer - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： ata: libata-sff: Ensure that we cannot write outside the allocated buffer - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： ata: libata-sff: Ensure that we cannot write outside the allocated buffer - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
标题： ata: libata-sff: Ensure that we cannot write outside the allocated buffer - kernel/git/stable/linux.git - Linux kernel stable tree -- 🔗来源链接

标签：
https://nvd.nist.gov/vuln/detail/CVE-2025-21738