CVE-2025-21724

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21724
In the Linux kernel, the following vulnerability has been resolved: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of type int) by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior. The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63) the shift operation overflows, as the result cannot be represented in a 32-bit type. To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type to match the operand's type.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/38ac76fc06bc6826a3e4b12a98efbe98432380a9 Patch
https://git.kernel.org/stable/c/44d9c94b7a3f29a3e07c4753603a35e9b28842a3 Patch
https://git.kernel.org/stable/c/b1f8453b8ff1ab79a03820ef608256c499769cb6 Patch
https://git.kernel.org/stable/c/d5d33f01b86af44b23eea61ee309e4ef22c0cdfe Patch
https://git.kernel.org/stable/c/e24c1551059268b37f6f40639883eafb281b8b9c Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 Oct 2025, 13:06

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/38ac76fc06bc6826a3e4b12a98efbe98432380a9 - () https://git.kernel.org/stable/c/38ac76fc06bc6826a3e4b12a98efbe98432380a9 - Patch
References () https://git.kernel.org/stable/c/44d9c94b7a3f29a3e07c4753603a35e9b28842a3 - () https://git.kernel.org/stable/c/44d9c94b7a3f29a3e07c4753603a35e9b28842a3 - Patch
References () https://git.kernel.org/stable/c/b1f8453b8ff1ab79a03820ef608256c499769cb6 - () https://git.kernel.org/stable/c/b1f8453b8ff1ab79a03820ef608256c499769cb6 - Patch
References () https://git.kernel.org/stable/c/d5d33f01b86af44b23eea61ee309e4ef22c0cdfe - () https://git.kernel.org/stable/c/d5d33f01b86af44b23eea61ee309e4ef22c0cdfe - Patch
References () https://git.kernel.org/stable/c/e24c1551059268b37f6f40639883eafb281b8b9c - () https://git.kernel.org/stable/c/e24c1551059268b37f6f40639883eafb281b8b9c - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux
Linux linux Kernel
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommufd/iova_bitmap: Se soluciona el problema de desplazamiento fuera de los límites en iova_bitmap_offset_to_index() Se soluciona un problema de desplazamiento fuera de los límites de UBSAN en iova_bitmap_offset_to_index() donde desplazar la constante "1" (de tipo int) por bitmap->mapped.pgshift (un valor unsigned long) podría resultar en un comportamiento indefinido. La constante "1" tiene como valor predeterminado un "int" de 32 bits, y cuando "pgshift" supera los 31 (por ejemplo, pgshift = 63) la operación de desplazamiento se desborda, ya que el resultado no se puede representar en un tipo de 32 bits. Para resolver esto, la constante se actualiza a "1UL", promoviéndola a un tipo unsigned long para que coincida con el tipo del operando.
CWE CWE-787

27 Feb 2025, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 02:15

Updated : 2025-10-23 13:06

NVD link : CVE-2025-21724

Mitre link : CVE-2025-21724

CVE.ORG link : CVE-2025-21724

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write