Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before b1f39c2a676698cc64c8e105e08b25111a112ec6; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before e03522a990cd2e0f1a736eaa349a9df9ab8541c3; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 8f6cfc3eca79b8e108d0823756101e2f4f9d811f; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 2e40c69b9c3448b9c6609cd02013da593b2e123b; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 177ee901aa2bab02e7f1f8edbb814fd5e386ed62; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before a80c33488e0bbe642ed803b13a4ac8078a70b507; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before f620c40ea6862feed84deb105568b21ec53a7830; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 894f98e73983f37354214a89a3a7fd35bf9e3072; affected f92b16b815efe8207090a9b5a767618fd89542ca; affected d2bbfac82b7942afc5d8e564d7087835280df495; affected a88e13d9a092fbb772d380944b44eb549ef131fe; affected dd807a784fd36f4136516d5858efb6473dda422c; affected 47cb14192bcbba3f15b1c3561e05e084e56fdef6; affected 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3; affected 9037306163a6ba5587e4b5ca511ac7be4fb7295b; affected 3.16.60 before 3.17; affected 3.18.108 before 3.19; affected 4.1.52 before 4.2; affected 4.4.131 before 4.5; affected 4.9.98 before 4.10; affected 4.14.39 before 4.15; affected 4.16.7 before 4.17 |
| Linux / Linux | affected 4.17; unaffected 0 before 4.17; unaffected 5.10.271 through 5.10.*; unaffected 5.15.222 through 5.15.*; unaffected 6.1.189 through 6.1.*; unaffected 6.6.158 through 6.6.*; unaffected 6.12.111 through 6.12.*; unaffected 6.18.53 through 6.18.*; unaffected 7.2.7 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/b1f39c2a676698cc64c8e105e08b25111a112ec6
- https://git.kernel.org/stable/c/e03522a990cd2e0f1a736eaa349a9df9ab8541c3
- https://git.kernel.org/stable/c/8f6cfc3eca79b8e108d0823756101e2f4f9d811f
- https://git.kernel.org/stable/c/2e40c69b9c3448b9c6609cd02013da593b2e123b
- https://git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62
- https://git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507
- https://git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830
- https://git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072