Описание
In the Linux kernel, the following vulnerability has been resolved:
virtio/vsock: Improve MSG_ZEROCOPY error handling
Add a missing kfree_skb() to prevent memory leaks.
A flaw was found in the Linux kernel's virtio virtual socket (vsock) implementation. This vulnerability can lead to a Denial of Service (DoS) caused by memory exhaustion. When an error occurs during zero-copy network transmissions (MSG_ZEROCOPY), the kernel fails to properly release allocated socket memory buffers. A local user can exploit this flaw by repeatedly triggering transmission errors, resulting in a memory leak that can degrade performance or render the system unresponsive.
Меры по смягчению последствий
Prevent the virtio vsock kernel module from loading if virtual socket communication between the host and virtual machine guests is not needed. To prevent the module from loading, create a configuration file in /etc/modprobe.d/:
echo "install vmw_vsock_virtio_transport /bin/true" >> /etc/modprobe.d/disable-vsock.conf
Alternatively, disable the core vsock module if no VSOCK functionality is required:
echo "install vsock /bin/true" >> /etc/modprobe.d/disable-vsock.conf
Caveat: Disabling these modules prevents virtual machine guest-host inter-process communication relying on AF_VSOCK. Warning: If the module is currently loaded into kernel memory, a system restart is required for the change to take full effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2025:6966 | 13.05.2025 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2025:6966 | 13.05.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Improve MSG_ZEROCOPY error handling Add a missing kfree_skb() to prevent memory leaks.
In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Improve MSG_ZEROCOPY error handling Add a missing kfree_skb() to prevent memory leaks.
In the Linux kernel, the following vulnerability has been resolved: v ...
In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Improve MSG_ZEROCOPY error handling Add a missing kfree_skb() to prevent memory leaks.
Уязвимость функции virtio_transport_send_pkt_info() модуля net/vmw_vsock/virtio_transport_common.c реализации сетевых функций ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
6.1 Medium
CVSS3