virtio_net: Fix resize of the RX ring
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.114, 6.18.57, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix resize of the RX ring When a AF_XDP socket is attached, the virtnet_rx_resize should resize the rq->xsk_buffs XSK buffer array. Otherwise, when the size grows, the virtnet_rx_resume() causes a write past the end of the array. This is easily reproducable with ethtool -G ens3 rx 32 ./xdpsock -i eth0 -q 0 -r -z & ethtool -G eth0 rx 256
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568 · fixed in 5c941b5d989a15cdaa987a2c602fb168461c6186; From e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568 · fixed in 5235abdb760bbd7a6fcecf1890b5160b7a75a9ce; From e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568 · fixed in 8344c9233c8f77017174d9e280c5a26034d068b6; From e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568 · fixed in d09c98a6da215bce2173a292e4b95c8de6ea5d51
- Linux Linux
6.11
- KernelLinux
From 6.11.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.6