Описание
In the Linux kernel, the following vulnerability has been resolved:
xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
When calling gnttab_end_foreign_access_ref() the returned value must be tested and the reaction to that value should be appropriate.
In case of failure in xennet_get_responses() the reaction should not be to crash the system, but to disable the network device.
The calls in setup_netfront() can be replaced by calls of gnttab_end_foreign_access(). While at it avoid double free of ring pages and grant references via xennet_disconnect_backend() in this case.
This is CVE-2022-23042 / part of XSA-396.
V2:
- avoid double free V3:
- remove pointless initializer (Jan Beulich)
In the Linux kernel, the following vulnerability has been resolved:
xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
When calling gnttab_end_foreign_access_ref() the returned value must be tested and the reaction to that value should be appropriate.
In case of failure in xennet_get_responses() the reaction should not be to crash the system, but to disable the network device.
The calls in setup_netfront() can be replaced by calls of gnttab_end_foreign_access(). While at it avoid double free of ring pages and grant references via xennet_disconnect_backend() in this case.
This is CVE-2022-23042 / part of XSA-396.
V2:
- avoid double free V3:
- remove pointless initializer (Jan Beulich)
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2022-48900
- https://git.kernel.org/stable/c/0e35f3ab69bcb01fdbf5aadc78f1731778963b1c
- https://git.kernel.org/stable/c/1b9f4115738af90427a8c94a3980bc52fbb23296
- https://git.kernel.org/stable/c/206c8e271ba2630f1d809123945d9c428f93b0f0
- https://git.kernel.org/stable/c/34630641e955f23ae06db178822d99d0a9d89b20
- https://git.kernel.org/stable/c/66e3531b33ee51dad17c463b4d9c9f52e341503d
- https://git.kernel.org/stable/c/c307029d811e03546d18d0e512fe295b3103b8e5
- https://git.kernel.org/stable/c/c4497b057b14274e159434f0ed70439a21f3d2a9
- https://git.kernel.org/stable/c/dea18aef2021022a568f4d385a1386f51a9df6ff
CVE ID
Связанные уязвимости
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved: xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.