In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: discard packets if the transport changes If the socket has been de-assigned or assigned to another transport, we must discard any packets received because they are not expected and would cause issues when we access vsk->transport. A possible scenario is described by Hyunwoo Kim in the attached link, where after a first connect() interrupted by a signal, and a second connect() failed, we can find `vsk->transport` at NULL, leading to a NULL pointer dereference.
En el kernel Linux, se ha resuelto la siguiente vulnerabilidad: vsock/virtio: descartar paquetes si cambia el transporte Si el socket ha sido desasignado o asignado a otro transporte, debemos descartar cualquier paquete recibido porque no son los esperados y causarían problemas cuando accedamos a vsk->transport. Un posible escenario es descrito por Hyunwoo Kim en el enlace adjunto, donde después de un primer connect() interrumpido por una señal, y un segundo connect() fallido, podemos encontrar `vsk->transport` en NULL, lo que lleva a una desreferencia de puntero NULL.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-476
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a0d8a00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341243500> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd34927d700> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b99ac80> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd36a0d9d00> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd36a0d8dc0> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd38542dcc0> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd310629540> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd341243440> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd36a0dbf00> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd340129f40> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:* |