Описание
In the Linux kernel, the following vulnerability has been resolved:
vhost: move vdpa group bound check to vhost_vdpa
Remove duplication by consolidating these here. This reduces the
posibility of a parent driver missing them.
While we're at it, fix a bug in vdpa_sim where a valid ASID can be
assigned to a group equal to ngroups, causing an out of bound write.
A flaw was found in the Linux kernel's vhost subsystem. Specifically, a bug in the vdpa_sim component allows for an out-of-bounds write when a valid ASID (Address Space ID) is incorrectly assigned to a vDPA (virtio Data Path Acceleration) group. This could lead to memory corruption, potentially resulting in a denial of service or other system instability.
Отчет
vhost vdpa did not centrally validate the group index before calling the driver set_group_asid operation. In vdpa_sim, a group value equal to ngroups could pass the old driver check and cause an out of bounds write when assigning a valid ASID to that group. For the CVSS the PR:L value is used because an attacker needs local access to the vhost vdpa or vdpa device interface, commonly through a VM or virtualization management process, but does not necessarily need kernel privileges once that interface is exposed. The issue is not network reachable by itself and is triggered through a local ioctl control path. Impact is at least local denial of service via kernel memory corruption and in the worst case may allow confidentiality or integrity impact due to an out of bounds write primitive.
Меры по смягчению последствий
To mitigate this issue, prevent module vdpa from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in vdpa_sim where a valid ASID can be assigned to a group equal to ngroups, causing an out of bound write.
In the Linux kernel, the following vulnerability has been resolved: vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in vdpa_sim where a valid ASID can be assigned to a group equal to ngroups, causing an out of bound write.
In the Linux kernel, the following vulnerability has been resolved: v ...
In the Linux kernel, the following vulnerability has been resolved: vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in vdpa_sim where a valid ASID can be assigned to a group equal to ngroups, causing an out of bound write.
EPSS
7.3 High
CVSS3