CVE-2025-38314 (GCVE-0-2025-38314)
Vulnerability from cvelistv5
Published
2025-07-10 07:42
Modified
2025-07-28 04:18
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio-pci: Fix result size returned for the admin command completion The result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes larger than the actual result data size. This occurs because the result_sg_size field of the command is filled with the result length from virtqueue_get_buf(), which includes both the data size and an additional 8 bytes of status. This oversized result size causes two issues: 1. The state transferred to the destination includes 8 bytes of extra data at the end. 2. The allocated buffer in the kernel may be smaller than the returned size, leading to failures when reading beyond the allocated size. The commit fixes this by subtracting the status size from the result of virtqueue_get_buf(). This fix has been tested through live migrations with virtio-net, virtio-net-transitional, and virtio-blk devices.
References
Impacted products
Vendor Product Version
Linux Linux Version: 704806ca400e5daa86c110f14bfdda9d28203bb7
Version: 704806ca400e5daa86c110f14bfdda9d28203bb7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/virtio/virtio_pci_modern.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "920b6720bb63893b81516c0c45884a8350f9e4bf",
              "status": "affected",
              "version": "704806ca400e5daa86c110f14bfdda9d28203bb7",
              "versionType": "git"
            },
            {
              "lessThan": "9ef41ebf787fcbde99ac404ae473f8467641f983",
              "status": "affected",
              "version": "704806ca400e5daa86c110f14bfdda9d28203bb7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/virtio/virtio_pci_modern.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-pci: Fix result size returned for the admin command completion\n\nThe result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes\nlarger than the actual result data size. This occurs because the\nresult_sg_size field of the command is filled with the result length\nfrom virtqueue_get_buf(), which includes both the data size and an\nadditional 8 bytes of status.\n\nThis oversized result size causes two issues:\n1. The state transferred to the destination includes 8 bytes of extra\n   data at the end.\n2. The allocated buffer in the kernel may be smaller than the returned\n   size, leading to failures when reading beyond the allocated size.\n\nThe commit fixes this by subtracting the status size from the result of\nvirtqueue_get_buf().\n\nThis fix has been tested through live migrations with virtio-net,\nvirtio-net-transitional, and virtio-blk devices."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:18:24.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/920b6720bb63893b81516c0c45884a8350f9e4bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ef41ebf787fcbde99ac404ae473f8467641f983"
        }
      ],
      "title": "virtio-pci: Fix result size returned for the admin command completion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38314",
    "datePublished": "2025-07-10T07:42:21.937Z",
    "dateReserved": "2025-04-16T04:51:24.003Z",
    "dateUpdated": "2025-07-28T04:18:24.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38314\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T08:15:30.363\",\"lastModified\":\"2025-07-10T13:17:30.017\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvirtio-pci: Fix result size returned for the admin command completion\\n\\nThe result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes\\nlarger than the actual result data size. This occurs because the\\nresult_sg_size field of the command is filled with the result length\\nfrom virtqueue_get_buf(), which includes both the data size and an\\nadditional 8 bytes of status.\\n\\nThis oversized result size causes two issues:\\n1. The state transferred to the destination includes 8 bytes of extra\\n   data at the end.\\n2. The allocated buffer in the kernel may be smaller than the returned\\n   size, leading to failures when reading beyond the allocated size.\\n\\nThe commit fixes this by subtracting the status size from the result of\\nvirtqueue_get_buf().\\n\\nThis fix has been tested through live migrations with virtio-net,\\nvirtio-net-transitional, and virtio-blk devices.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio-pci: Se corrige el tama\u00f1o del resultado devuelto para la finalizaci\u00f3n del comando admin El tama\u00f1o del resultado devuelto por virtio_pci_admin_dev_parts_get() es 8 bytes m\u00e1s grande que el tama\u00f1o real de los datos del resultado. Esto ocurre porque el campo result_sg_size del comando se llena con la longitud del resultado de virtqueue_get_buf(), que incluye tanto el tama\u00f1o de los datos como 8 bytes adicionales de estado. Este tama\u00f1o de resultado sobredimensionado causa dos problemas: 1. El estado transferido al destino incluye 8 bytes de datos adicionales al final. 2. El b\u00fafer asignado en el kernel puede ser m\u00e1s peque\u00f1o que el tama\u00f1o devuelto, lo que provoca fallas al leer m\u00e1s all\u00e1 del tama\u00f1o asignado. La confirmaci\u00f3n corrige esto restando el tama\u00f1o del estado del resultado de virtqueue_get_buf(). Esta correcci\u00f3n se ha probado a trav\u00e9s de migraciones en vivo con dispositivos virtio-net, virtio-net-transitional y virtio-blk. \"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/920b6720bb63893b81516c0c45884a8350f9e4bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9ef41ebf787fcbde99ac404ae473f8467641f983\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.