Description
In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix f_pos race in qat_vf_resume_write() qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurrent writers could therefore pass the bounds check with the old offset, then have the second writer copy after the first advanced f_pos, writing past the end of the migration-state buffer. Take migf->lock before doing the boundary checks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
bb208810b1abf1c84870cfbe1cc9cf1a1d35c607 to < 6465af0004dc1b067129a26ef44f19cdf13bbce6affectedbb208810b1abf1c84870cfbe1cc9cf1a1d35c607 to < d416dcefdbac90d96b22485fd93f28229ad9984baffectedbb208810b1abf1c84870cfbe1cc9cf1a1d35c607 to < b6fd7a40a66485c8aa8156d8fcf50b95cb8ba281affectedbb208810b1abf1c84870cfbe1cc9cf1a1d35c607 to < 4ec5e932e636896e97e4c6a8205b0ac76d52421aaffected
Linux Linux
Default version status: affected
6.10affected0 to < 6.10unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected