vsock/virtio: discard packets if the transport changes
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.10.234, 5.15.177, 6.1.127, 6.6.74, 6.12.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: discard packets if the transport changes If the socket has been de-assigned or assigned to another transport, we must discard any packets received because they are not expected and would cause issues when we access vsk->transport. A possible scenario is described by Hyunwoo Kim in the attached link, where after a first connect() interrupted by a signal, and a second connect() failed, we can find `vsk->transport` at NULL, leading to a NULL pointer dereference.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Linux Linux
From c0cfa2d8a788fcf45df5bf4070ab2474c88d543a · fixed in 18a7fc371d1dbf8deff16c2dd9292bcc73f43040; From c0cfa2d8a788fcf45df5bf4070ab2474c88d543a · fixed in 6486915fa661584d70e8e7e4068c6c075c67dd6d; From c0cfa2d8a788fcf45df5bf4070ab2474c88d543a · fixed in 88244163bc7e7b0ce9dd7bf4c8a563b41525c3ee; From c0cfa2d8a788fcf45df5bf4070ab2474c88d543a · fixed in d88b249e14bd0ee1e46bbe4f456e22e01b8c68de; From c0cfa2d8a788fcf45df5bf4070ab2474c88d543a · fixed in 677579b641af109613564460a4e3bdcb16850b61; From c0cfa2d8a788fcf45df5bf4070ab2474c88d543a · fixed in 2cb7c756f605ec02ffe562fb26828e4bcc5fdfc1
- Linux Linux
5.5
- KernelLinux
From 5.5.0 · fixed in 5.10.234; From 5.11.0 · fixed in 5.15.177; From 5.16.0 · fixed in 6.1.127; From 6.2.0 · fixed in 6.6.74; From 6.7.0 · fixed in 6.12.11