Description
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue. Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
762c251c7f5c4ee5bef71460c6e822ed293fd69f to < 941329ce14c5f481223a10d1d4c8b57ea7f3048aaffectedbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to < 29dd10583bf9d2744cd84b862e4257c0a5699570affectedbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to < a1fb0c5b8a7c2753758aeced40971f99449dde0caffectedbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to < eae099c764c7ebdb842eb1f638913e310bdd6513affectedbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to < bd43a7ec668be428265b3209eb43647aedcf720aaffectedbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to < 1cecb4202afdbeddcf29d59baf596ac6ab753f7faffectedbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to < ebac8f6b1ef0e9278afe204b8692a7479988daceaffected5.15.138 to < 5.15.216affected
Linux Linux
Default version status: affected
5.19affected0 to < 5.19unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.152 to ≤ 6.6.*unaffected6.12.104 to ≤ 6.12.*unaffected6.18.45 to ≤ 6.18.*unaffected7.1.9 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a ↗
- https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570 ↗
- https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c ↗
- https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513 ↗
- https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a ↗
- https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f ↗
- https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace ↗