In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost-scsi: reject feature changes after endpoint<\/p>\n
vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates
\neach command’s protection scatterlist array (prot_sgl) according to the
\nacknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt
\nwhen VHOST_SET_FEATURES changes that bit later.<\/p>\n
Although virtio feature bits must not change after feature negotiation,
\nvhost_scsi_set_features() currently accepts such a request after the
\nendpoint is active and updates acked_features. Enabling T10-PI after
\nendpoint setup therefore leaves prot_sgl NULL while the I\/O path follows
\nthe new feature bit.<\/p>\n
For a 129-page protection payload, vhost_scsi_mapal() passes the missing
\nfirst chunk to sg_alloc_table_chained():<\/p>\n
sg_alloc_table_chained(table, 129, first_chunk=NULL,
\n nents_first_chunk=inline_sg_cnt)<\/p>\n
sg_pool_index() then hits:<\/p>\n
BUG_ON(nents > SG_CHUNK_SIZE); \/* 129 > 128 *\/<\/p>\n
The kernel reported the following call trace and register state:<\/p>\n
Call Trace:<\/p>\n
? __sg_alloc_table+0x1d8\/0x250
\n ? __pfx_vhost_run_work_list+0x10\/0x10 [vhost]
\n sg_alloc_table_chained+0x59\/0xf0
\n ? __pfx_sg_pool_alloc+0x10\/0x10
\n ? vhost_scsi_calc_sgls.constprop.0+0x43\/0x60 [vhost_scsi]
\n vhost_scsi_handle_vq+0xf02\/0x1700 [vhost_scsi]
\n ? __pfx_vhost_scsi_handle_vq+0x10\/0x10 [vhost_scsi]
\n vhost_scsi_handle_kick+0x37\/0x50 [vhost_scsi]
\n vhost_run_work_list+0x8e\/0xd0 [vhost]
\n vhost_task_fn+0xe1\/0x210
\n ret_from_fork+0x348\/0x540<\/p>\n
RIP: 0010:0x4
\n CR2 = 0x4
\n RSP: 0018:ffffc90000dbf940 EFLAGS: 00010202
\n RAX: ffffffff82396810 RBX: ffff88811dc28b80 RCX: 0000000000000000
\n RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000081<\/p>\n
VHOST_F_LOG_ALL is a vhost-specific runtime feature and remains the only
\nexception.<\/p>\n
Reject changes to any feature other than VHOST_F_LOG_ALL while the
\nendpoint is active. This preserves the existing runtime log toggle while
\npreventing feature-dependent command resources and data-path state from
\nbecoming inconsistent. Userspace must clear the endpoint before changing
\nany other negotiated feature and set the endpoint up again afterward.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost-scsi: reject feature changes after endpoint<\/p>\n
vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates
\neach <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11272","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11272","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}