In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one().
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: tap: liberar página en las rutas de error en tap_get_user_xdp() tap_get_user_xdp() rechaza una trama más corta que ETH_HLEN con -EINVAL, y devuelve -ENOMEM cuando build_skb() falla. Ambas rutas saltan a la etiqueta err sin liberar la página que vhost_net_build_xdp() asignó para la trama. tap_sendmsg() descarta el valor de retorno por búfer y siempre devuelve 0, por lo que vhost_tx_batch() toma la ruta de éxito y nunca libera la página; cada trama rechazada en un lote filtra un fragmento de página. Liberar la página en ambas rutas de error, antes de que se construya el skb. Esta es la contraparte de tap de la misma fuga en tun_xdp_one().
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
| Attack Vector | ADJACENT_NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | CHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 2.8
Impact Score: 4.0
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd342318f80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd342319d40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2d3999dc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340aca640> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd34231b380> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd342319340> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340af6040> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd340f0d5c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd340f0c580> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd34231aac0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd340f0df00> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd342318b40> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |