In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
virtio_console: do not free control-out buffers on remove<\/p>\n
__send_control_msg() publishes &portdev->cpkt as the control-out
\nvirtqueue cookie. remove_vqs() walks every virtqueue and passes leftover
\ncookies to free_buf(), which treats them as struct port_buffer and
\nreads sgpages.<\/p>\n
If a control message is still on c_ovq when the device is unbound,
\nfree_buf() reads past the ports_device object.<\/p>\n
KASAN reported slab-out-of-bounds in free_buf():<\/p>\n
\tfree_buf
\n\tremove_vqs
\n\tvirtcons_remove
\n\tunbind_store<\/p>\n
The object was the ports_device allocated in virtcons_probe().<\/p>\n
Drain c_ovq without freeing. The packet lives in portdev and is released
\nwith it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
virtio_console: do not free control-out buffers on remove<\/p>\n
__send_control_msg() publishes &portdev->cpkt as the control-out
\nvirtque<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29151","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}