In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each short frame in a batch leaks one page-frag chunk. A local process that can open /dev/net/tun and /dev/vhost-net can hit this path: it attaches a tun/tap device as the vhost-net backend and feeds TX descriptors whose length minus the virtio-net header is below ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a tight submission loop exhausts host memory and triggers an OOM panic. Free the page before returning -EINVAL, matching the XDP-program error path in the same function.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: tun: liberar página en el rechazo de tramas cortas en tun_xdp_one() tun_xdp_one() devuelve -EINVAL en una trama más corta que ETH_HLEN sin liberar la página que vhost_net_build_xdp() asignó para ella. tun_sendmsg() descarta ese -EINVAL y aún devuelve total_len, por lo que vhost_tx_batch() toma la ruta de éxito y nunca libera la página; cada trama corta en un lote filtra un chunk de fragmento de página. Un proceso local que puede abrir /dev/net/tun y /dev/vhost-net puede alcanzar esta ruta: adjunta un dispositivo tun/tap como el backend de vhost-net y alimenta descriptores TX cuya longitud menos el encabezado virtio-net está por debajo de ETH_HLEN. Cada kick filtra los chunks de fragmentos de página para ese lote, y un bucle de envío ajustado agota la memoria del host y desencadena un pánico OOM. Liberar la página antes de devolver -EINVAL, coincidiendo con la ruta de error del programa XDP en la misma función.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | CHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 2.5
Impact Score: 4.0
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385555680> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4dc680> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385555b00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385556a40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385555d00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385554dc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385556b40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2983c6080> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385554fc0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd385556ac0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3694d8340> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd39c4de880> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3081a7980> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd39c4dc500> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |