Description
In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path. Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes. I found this bug myself, though the patch was written with AI assistance.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
cfe226892913a448e83e7a19db93862baa3cb99c to < 1b803d382cde6d85755b363f22010208a04ba40aaffectedcfe226892913a448e83e7a19db93862baa3cb99c to < c001abcde865b74231da8f1412c3217dbf66781eaffectedcfe226892913a448e83e7a19db93862baa3cb99c to < 3af20238a09ca180d66623e3bed16b64e9975f39affectedcfe226892913a448e83e7a19db93862baa3cb99c to < 2bbf1c1f69991e28787e02b0a2f826289d5fc730affectedcfe226892913a448e83e7a19db93862baa3cb99c to < 0d195797a80b77f2ec56718cd26d3ee65d0093e8affected
Linux Linux
Default version status: affected
5.19affected0 to < 5.19unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1b803d382cde6d85755b363f22010208a04ba40a ↗
- https://git.kernel.org/stable/c/c001abcde865b74231da8f1412c3217dbf66781e ↗
- https://git.kernel.org/stable/c/3af20238a09ca180d66623e3bed16b64e9975f39 ↗
- https://git.kernel.org/stable/c/2bbf1c1f69991e28787e02b0a2f826289d5fc730 ↗
- https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8 ↗