Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue. Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 762c251c7f5c4ee5bef71460c6e822ed293fd69f before 941329ce14c5f481223a10d1d4c8b57ea7f3048a; affected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before 29dd10583bf9d2744cd84b862e4257c0a5699570; affected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before a1fb0c5b8a7c2753758aeced40971f99449dde0c; affected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before eae099c764c7ebdb842eb1f638913e310bdd6513; affected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before bd43a7ec668be428265b3209eb43647aedcf720a; affected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before 1cecb4202afdbeddcf29d59baf596ac6ab753f7f; affected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before ebac8f6b1ef0e9278afe204b8692a7479988dace; affected 5.15.138 before 5.15.216 |
| Linux / Linux | affected 5.19; unaffected 0 before 5.19; unaffected 5.15.216 through 5.15.*; unaffected 6.1.183 through 6.1.*; unaffected 6.6.152 through 6.6.*; unaffected 6.12.104 through 6.12.*; unaffected 6.18.45 through 6.18.*; unaffected 7.1.9 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a
- https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570
- https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c
- https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513
- https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a
- https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f
- https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace
ADP enrichment
No English description supplied.
No references supplied.