In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost: reset the vring metadata cache on vring reconfiguration<\/p>\n
vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring
\nmetadata region, and iotlb_access_ok() returns early on a cache hit,
\ntaking the hit as proof that the region has already been validated:<\/p>\n
\tif (vhost_vq_meta_fetch(vq, addr, len, type))
\n\t\treturn true;<\/p>\n
The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on
\ndevice IOTLB (re)initialisation and on vq reset, but not when
\nVHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when
\nVHOST_SET_VRING_NUM changes the region sizes.<\/p>\n
With a device IOTLB attached both ioctls are accepted while the vq is
\nlive, and neither validates the addresses at ioctl time: vq_access_ok()
\nand vq_log_used_access_ok() return true early because the addresses are
\nGIOVAs, deferring validation to prefetch time. Once the cache has been
\npopulated that deferred validation no longer runs — vq_meta_prefetch()
\nhits the stale entry and returns true — and vhost_vq_meta_fetch() keeps
\ntranslating through the old mapping as<\/p>\n
\tmap->addr + addr – map->start<\/p>\n
for an address the mapping no longer covers. vhost_copy_to_user() and
\nvhost_copy_from_user() consume the result with __copy_to_user() and
\n__copy_from_user(), which do not check it either, so a subsequent used
\nring update or descriptor fetch accesses memory outside the region the
\nIOTLB actually maps.<\/p>\n
Reset the metadata cache whenever the vring is reconfigured, so the new
\naddresses are pushed back through iotlb_access_ok()’s slow path.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost: reset the vring metadata cache on vring reconfiguration<\/p>\n
vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring
\nm<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11114","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11114","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11114"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11114"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}