CVE-2021-47604

vduse: check that offset is within bounds in get_config()

Severity Score

"-"

*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

vduse: check that offset is within bounds in get_config()

This condition checks "len" but it does not check "offset" and that
could result in an out of bounds read if "offset > dev->config_size".
The problem is that since both variables are unsigned the
"dev->config_size - offset" subtraction would result in a very high
unsigned value.

I think these checks might not be necessary because "len" and "offset"
are supposed to already have been validated using the
vhost_vdpa_config_validate() function. But I do not know the code
perfectly, and I like to be safe.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vduse: verifique que el desplazamiento esté dentro de los límites en get_config() Esta condición verifica "len" pero no verifica "desplazamiento" y eso podría resultar en una lectura fuera de los límites si " desplazamiento > dev->config_size". El problema es que, dado que ambas variables no están firmadas, la resta "dev->config_size - offset" daría como resultado un valor sin firmar muy alto. Creo que estas comprobaciones podrían no ser necesarias porque se supone que "len" y "offset" ya se han validado mediante la función vhost_vdpa_config_validate(). Pero no conozco el código a la perfección y me gusta estar seguro.

*Credits: N/A

CVSS Scores

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-24 CVE Reserved
2024-06-19 CVE Published
2024-06-20 EPSS Updated
2024-09-11 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (3)

URL	Tag	Source
https://git.kernel.org/stable/c/c8a6153b6c59d95c0e091f053f6f180952ade91e	Vuln. Introduced

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/ebbbc5fea3f648175df1aa3f127c78eb0252cc2a	2021-12-22
https://git.kernel.org/stable/c/dc1db0060c02d119fd4196924eff2d1129e9a442	2021-12-08

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.15 < 5.15.11 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.15 < 5.15.11"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.15 < 5.16 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.15 < 5.16"		en		Affected