CVE-2025-21832 (GCVE-0-2025-21832)
Vulnerability from cvelistv5
Published
2025-03-06 16:22
Modified
2025-05-10 16:48
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: block: don't revert iter for -EIOCBQUEUED blkdev_read_iter() has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero (where bigger than makes more sense), and not checking the return value of blkdev_direct_IO() before doing an iov_iter_revert(). The latter can lead to attempting to revert with a negative value, which when passed to iov_iter_revert() as an unsigned value will lead to throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT. Be sane and don't revert for -EIOCBQUEUED, like what is done in other spots.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3e1f941dd9f33776b3df4e30f741fe445ff773f3
Version: 3e1f941dd9f33776b3df4e30f741fe445ff773f3
Version: 3e1f941dd9f33776b3df4e30f741fe445ff773f3
Version: 3e1f941dd9f33776b3df4e30f741fe445ff773f3
Version: 3e1f941dd9f33776b3df4e30f741fe445ff773f3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/fops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6c26619effb1b4cb7d20b4e666ab8f71f6a53ccb",
              "status": "affected",
              "version": "3e1f941dd9f33776b3df4e30f741fe445ff773f3",
              "versionType": "git"
            },
            {
              "lessThan": "84671b0630ccb46ae9f1f99a45c7d63ffcd6a474",
              "status": "affected",
              "version": "3e1f941dd9f33776b3df4e30f741fe445ff773f3",
              "versionType": "git"
            },
            {
              "lessThan": "68f16d3034a06661245ecd22f0d586a8b4e7c473",
              "status": "affected",
              "version": "3e1f941dd9f33776b3df4e30f741fe445ff773f3",
              "versionType": "git"
            },
            {
              "lessThan": "a58f136bad29f9ae721a29d98c042fddbee22f77",
              "status": "affected",
              "version": "3e1f941dd9f33776b3df4e30f741fe445ff773f3",
              "versionType": "git"
            },
            {
              "lessThan": "b13ee668e8280ca5b07f8ce2846b9957a8a10853",
              "status": "affected",
              "version": "3e1f941dd9f33776b3df4e30f741fe445ff773f3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/fops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don\u0027t revert iter for -EIOCBQUEUED\n\nblkdev_read_iter() has a few odd checks, like gating the position and\ncount adjustment on whether or not the result is bigger-than-or-equal to\nzero (where bigger than makes more sense), and not checking the return\nvalue of blkdev_direct_IO() before doing an iov_iter_revert(). The\nlatter can lead to attempting to revert with a negative value, which\nwhen passed to iov_iter_revert() as an unsigned value will lead to\nthrowing a WARN_ON() because unroll is bigger than MAX_RW_COUNT.\n\nBe sane and don\u0027t revert for -EIOCBQUEUED, like what is done in other\nspots."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-10T16:48:42.602Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6c26619effb1b4cb7d20b4e666ab8f71f6a53ccb"
        },
        {
          "url": "https://git.kernel.org/stable/c/84671b0630ccb46ae9f1f99a45c7d63ffcd6a474"
        },
        {
          "url": "https://git.kernel.org/stable/c/68f16d3034a06661245ecd22f0d586a8b4e7c473"
        },
        {
          "url": "https://git.kernel.org/stable/c/a58f136bad29f9ae721a29d98c042fddbee22f77"
        },
        {
          "url": "https://git.kernel.org/stable/c/b13ee668e8280ca5b07f8ce2846b9957a8a10853"
        }
      ],
      "title": "block: don\u0027t revert iter for -EIOCBQUEUED",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21832",
    "datePublished": "2025-03-06T16:22:34.125Z",
    "dateReserved": "2024-12-29T08:45:45.777Z",
    "dateUpdated": "2025-05-10T16:48:42.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21832\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-06T17:15:23.177\",\"lastModified\":\"2025-03-06T17:15:23.177\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock: don\u0027t revert iter for -EIOCBQUEUED\\n\\nblkdev_read_iter() has a few odd checks, like gating the position and\\ncount adjustment on whether or not the result is bigger-than-or-equal to\\nzero (where bigger than makes more sense), and not checking the return\\nvalue of blkdev_direct_IO() before doing an iov_iter_revert(). The\\nlatter can lead to attempting to revert with a negative value, which\\nwhen passed to iov_iter_revert() as an unsigned value will lead to\\nthrowing a WARN_ON() because unroll is bigger than MAX_RW_COUNT.\\n\\nBe sane and don\u0027t revert for -EIOCBQUEUED, like what is done in other\\nspots.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloque: no revertir iter para -EIOCBQUEUED blkdev_read_iter() tiene algunas comprobaciones extra\u00f1as, como bloquear el ajuste de posici\u00f3n y conteo en funci\u00f3n de si el resultado es o no mayor o igual a cero (donde mayor que tiene m\u00e1s sentido), y no verificar el valor de retorno de blkdev_direct_IO() antes de hacer un iov_iter_revert(). Esto \u00faltimo puede llevar a intentar revertir con un valor negativo, que cuando se pasa a iov_iter_revert() como un valor sin signo conducir\u00e1 a lanzar un WARN_ON() porque unroll es mayor que MAX_RW_COUNT. Sea sensato y no revierta para -EIOCBQUEUED, como lo que se hace en otros lugares.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/68f16d3034a06661245ecd22f0d586a8b4e7c473\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6c26619effb1b4cb7d20b4e666ab8f71f6a53ccb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/84671b0630ccb46ae9f1f99a45c7d63ffcd6a474\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a58f136bad29f9ae721a29d98c042fddbee22f77\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b13ee668e8280ca5b07f8ce2846b9957a8a10853\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.