In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vduse: validate virtqueue alignment<\/p>\n
vduse_validate_config() only checks the upper bound of vq_align. Invalid
\nvalues can therefore reach vring_create_virtqueue_map(). The split-ring
\nhelpers use align – 1 as a bit mask, so the alignment must be a non-zero
\npower of two. A zero value makes vring_size() drop the descriptor and
\navailable-ring part and vring_init() leave the used ring pointer NULL.<\/p>\n
The VIRTIO spec requires the used ring to start at an address
\naligned to at least 4 bytes. Reject values below VRING_USED_ALIGN_SIZE as
\nwell as non-power-of-two values before they reach the virtio ring helpers.<\/p>\n
Opening a virtio-net device created with vq_align=0 triggered:<\/p>\n
BUG: KASAN: null-ptr-deref in virtqueue_kick_prepare_split+0xe3\/0x100
\nRead of size 2 at addr 0000000000000000 by task systemd-network\/1062<\/p>\n
Call Trace (relevant frames):
\n dump_stack_lvl
\n print_report
\n kasan_report
\n __asan_load2
\n virtqueue_kick_prepare_split+0xe3\/0x100
\n virtqueue_kick_prepare+0x40\/0x60
\n try_fill_recv+0x857\/0x1250
\n virtnet_open+0x189\/0x460
\n __dev_open+0x225\/0x390
\n __dev_change_flags+0x368\/0x3b0
\n netif_change_flags+0x56\/0xc0
\n do_setlink.isra.0+0x68c\/0x1e30<\/p>\n
Validate the value before it reaches the virtio ring helpers.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vduse: validate virtqueue alignment<\/p>\n
vduse_validate_config() only checks the upper bound of vq_align. Invalid
\nvalues can therefore <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29145","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}