CVE-2025-21927

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21927
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst() to access memory outside the allocated area and cause memory corruptions by overwriting it with the calculated digest. Fix this by rejecting packets with an unexpected header length.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126 Patch
https://git.kernel.org/stable/c/9fbc953d6b38bc824392e01850f0aeee3b348722 Patch
https://git.kernel.org/stable/c/ad95bab0cd28ed77c2c0d0b6e76e03e031391064 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
History

11 Apr 2025, 13:11

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-tcp: se corrige una posible corrupción de memoria en nvme_tcp_recv_pdu(). nvme_tcp_recv_pdu() no comprueba la validez de la longitud del encabezado. Cuando se habilitan los resúmenes de encabezado, un destino podría enviar un paquete con una longitud de encabezado no válida (p. ej., 255), lo que provoca que nvme_tcp_verify_hdgst() acceda a memoria fuera del área asignada y provoque corrupciones de memoria al sobrescribirla con el resumen calculado. Para solucionar esto, rechace los paquetes con una longitud de encabezado inesperada.
CWE CWE-787
References () https://git.kernel.org/stable/c/22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126 - () https://git.kernel.org/stable/c/22b06c89aa6b2d1ecb8aea72edfb9d53af8d5126 - Patch
References () https://git.kernel.org/stable/c/9fbc953d6b38bc824392e01850f0aeee3b348722 - () https://git.kernel.org/stable/c/9fbc953d6b38bc824392e01850f0aeee3b348722 - Patch
References () https://git.kernel.org/stable/c/ad95bab0cd28ed77c2c0d0b6e76e03e031391064 - () https://git.kernel.org/stable/c/ad95bab0cd28ed77c2c0d0b6e76e03e031391064 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux

01 Apr 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 16:15

Updated : 2025-04-11 13:11

NVD link : CVE-2025-21927

Mitre link : CVE-2025-21927

CVE.ORG link : CVE-2025-21927

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write