In the Linux kernel, the following vulnerability has been resolved:
vduse: check that offset is within bounds in get_config()
This condition checks "len" but it does not check "offset" and that could result in an out of bounds read if "offset > dev->config_size". The problem is that since both variables are unsigned the "dev->config_size - offset" subtraction would result in a very high unsigned value.
I think these checks might not be necessary because "len" and "offset" are supposed to already have been validated using the vhost_vdpa_config_validate() function. But I do not know the code perfectly, and I like to be safe.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-devel-rtUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-rtUpgrade kernel-devel-azureUpgrade kernel-rt-livepatchUpgrade kernel-rt-develUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-rtUpgrade ocfs2-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-source-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-azure-optionalUpgrade kernel-azure-vdsoUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-optionalUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-azure-extraUpgrade kselftests-kmp-rtUpgrade kernel-azureUpgrade kernel-rt_debugUpgrade kernel-source-rtUpgrade kernel-rt-extraUpgrade kernel-syms-rtUpgrade kselftests-kmp-azureUpgrade kernel-azure-develUpgrade kernel-rt_debug-develUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-azure | Aug 9, 2024 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub