In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost\/vdpa: reject VRING_NUM larger than device max<\/p>\n
vhost_vring_set_num() accepts any non-zero power-of-two queue size that
\nfits in 16 bits. vhost-vdpa then passes that value to set_vq_num()
\nwithout comparing it with get_vq_num_max().<\/p>\n
A process with access to \/dev\/vhost-vdpa-* can therefore configure a
\nqueue larger than the device advertises. With vdpa_sim, the worker can
\nwalk descriptors beyond the mapped descriptor ring. KASAN reports a
\n16-byte out-of-bounds read, corresponding to one vring_desc, in the
\nvringh IOTLB path:<\/p>\n
BUG: KASAN: out-of-bounds in _copy_from_iter
\n Read of size 16
\n copy_from_iotlb
\n copydesc_iotlb
\n vringh_getdesc_iotlb
\n vdpasim_net_work<\/p>\n
Cache get_vq_num_max() immediately after reset. Some backends derive
\nit from writable queue-size state, so querying it after SET_NUM may
\nreturn the current size instead of the device capability. Invalidate
\nthe cached value before reset so a failed reset leaves SET_NUM
\ndisabled.<\/p>\n
For VHOST_SET_VRING_NUM, copy the complete vring state once and use
\nthe same index and size for validation, vq->num, and set_vq_num().
\nThis ensures that validation and use operate on the same copied values.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost\/vdpa: reject VRING_NUM larger than device max<\/p>\n
vhost_vring_set_num() accepts any non-zero power-of-two queue size that
\nfits i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29150","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29150","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29150"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29150"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29150"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}