LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer

In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory. While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug. Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer. Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A locally authenticated user with access to the relevant storage-device interface may trigger a Linux kernel memory overwrite. Successful exploitation could crash the system or potentially compromise kernel confidentiality and integrity. The issue is high severity, but the supplied sources provide no evidence of active exploitation.

Executive priority

Prioritize remediation on shared Linux hosts, virtualization environments, and systems where untrusted local users can access storage interfaces. Treat internet exposure alone as insufficient evidence of reachability. Patch through supported kernel channels promptly, while validating actual device permissions and deployed kernel versions.

Technical view

The libata-sff ata_pio_sector() path lacked a buffer-boundary check. A specially formed SCSI command using ATA pass-through and PIO could make the kernel write beyond an allocated buffer. The published correction adds a safety check similar to __atapi_pio_bytes(). The report also notes unresolved uncertainty involving ATA_NOP status handling in libata-sff or QEMU.

Likely exposure

Exposure is limited to Linux systems using the affected libata-sff path where a low-privileged local user can issue relevant SCSI ioctls to an ATA device. Network-only attackers are not represented by the supplied CVSS vector. The provided version data is ambiguous, so kernel and distribution advisory mapping is necessary.

Exploitation context

CVSS 3.1 rates this 7.8: local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact. The source bundle marks KEV false and provides no evidence of public or active exploitation. Practical reachability depends on device access permissions and storage configuration.

Researcher notes

The reported condition involves ata_pio_sector() processing, an oversized output length, ATA_16 pass-through, ATA_NOP, and PIO protocol. The fix bounds writes to the allocated buffer. The source acknowledges a potentially separate libata-sff or QEMU status-handling defect. Exact vulnerable-to-fixed version ranges are not reliably expressed in the supplied bundle.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable upstream stable fix or distribution backport.
  • Review the Debian advisory if operating an affected Debian LTS release.
  • Restrict untrusted users from issuing raw SCSI or ATA pass-through operations where operationally feasible.
  • Check current Linux vendor guidance because the supplied affected-version mapping is incomplete.

Validation and detection

  • Record the running kernel and distribution package versions across potentially exposed Linux systems.
  • Confirm vendor packages include the applicable stable commit or documented backport.
  • Identify systems using libata-sff and ATA devices accessible through relevant SCSI interfaces.
  • Review permissions granting non-administrative users direct storage-device or pass-through access.
  • After updating, verify systems booted into the corrected kernel rather than an older installed kernel.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21738 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-21738Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5a5dbd18a7496ed403f6f54bb20c955c65482fa5, 5a5dbd18a7496ed403f6f54bb20c955c65482fa5, 5a5dbd18a7496ed403f6f54bb20c955c65482fa5, 5a5dbd18a7496ed403f6f54bb20c955c65482fa5, 5a5dbd18a7496ed403f6f54bb20c955c65482fa5unaffected
LinuxLinux2.6.22, 0, 6.1.129, 6.6.78, 6.12.14, 6.13.3, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.