In the Linux kernel, the following vulnerability has been resolved:
vdpa_sim_net: check TX pull result before RX copy
vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is
currently added to the unsigned byte counter and then passed as a size_t
length to receive_filter() and vringh_iov_push_iotlb(). A negative error
can therefore become a large length in the RX path.
Handle non-positive pull results before every length use. Count the TX
error and complete the consumed TX descriptor with zero bytes.
I found this bug myself, though the patch was written with AI assistance.
CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:H
CVSS Score: 7.5
AV:L - The malformed input is a virtqueue TX descriptor with an unmapped address, written into the vring by whoever drives the vdpa_sim_net device (a guest via vhost-vdpa or a local vhost-vdpa user). vdpasim_net_work() processes it and no network protocol carries it.
AC:H - Once reached, the failed vringh_iov_pull_iotlb() is deterministic. But it requires an admin to create a vdpa_sim_net device (a test-only simulator under RUNTIME_TESTING_MENU) and assign it to the attacker's VM or process, a configuration the attacker cannot produce.
PR:L - Device creation needs GENL_ADMIN_PERM in init_net (not reachable via user namespaces). The attacker is the guest or process given the device, which only needs ordinary control of its own virtqueues and no host privileges.
UI:N - The attacker queues a broadcast TX frame, then a TX descriptor that fails IOTLB translation, plus large RX descriptors, all on their own rings. No victim action is needed.
S:C - A guest driving vdpa_sim_net through vhost-vdpa causes the host kernel to copy host heap memory into guest-visible RX buffers, crossing the VM-to-host boundary.
C:H - The negative read, cast to size_t, is passed to vringh_iov_push_iotlb(). It copies from the PAGE_SIZE net->buffer up to the attacker-sized RX iov, leaking adjacent host kernel heap (an out-of-bounds read not limited to a few bytes) into attacker memory.
I:N - The overlong copy only reads kernel memory and writes into the attacker's own RX buffers; no kernel memory is written. The only other effect is corrupted tx_bytes statistics.
A:H - A large RX descriptor chain makes the out-of-bounds read of net->buffer run into unmapped memory, oopsing the host kernel and taking down every guest on it.
| Attack Vector |
Local |
Scope |
Changed |
| Attack Complexity |
High |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The malformed input is a virtqueue TX descriptor with an unmapped address, written into the vring by whoever drives the vdpa_sim_net device (a guest via vhost-vdpa or a local vhost-vdpa user). vdpasim_net_work() processes it and no network protocol carries it.
AC:H - Once reached, the failed vringh_iov_pull_iotlb() is deterministic. But it requires an admin to create a vdpa_sim_net device (a test-only simulator under RUNTIME_TESTING_MENU) and assign it to the attacker's VM or process, a configuration the attacker cannot produce.
PR:L - Device creation needs GENL_ADMIN_PERM in init_net (not reachable via user namespaces). The attacker is the guest or process given the device, which only needs ordinary control of its own virtqueues and no host privileges.
UI:N - The attacker queues a broadcast TX frame, then a TX descriptor that fails IOTLB translation, plus large RX descriptors, all on their own rings. No victim action is needed.
S:C - A guest driving vdpa_sim_net through vhost-vdpa causes the host kernel to copy host heap memory into guest-visible RX buffers, crossing the VM-to-host boundary.
C:H - The negative read, cast to size_t, is passed to vringh_iov_push_iotlb(). It copies from the PAGE_SIZE net->buffer up to the attacker-sized RX iov, leaking adjacent host kernel heap (an out-of-bounds read not limited to a few bytes) into attacker memory.
I:N - The overlong copy only reads kernel memory and writes into the attacker's own RX buffers; no kernel memory is written. The only other effect is corrupted tx_bytes statistics.
A:H - A large RX descriptor chain makes the out-of-bounds read of net->buffer run into unmapped memory, oopsing the host kernel and taking down every guest on it.
CVSS 3.1