In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk. Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: tun: liberar página en caso de fallo de build_skb() en tun_xdp_one() Cuando build_skb() falla en tun_xdp_one(), la función establece ret en -ENOMEM y salta a la etiqueta out, la cual retorna sin liberar la página que vhost_net_build_xdp() asignó para el frame. Al igual que con la ruta de rechazo de frames cortos, tun_sendmsg() descarta el error por búfer y aún retorna total_len, por lo que vhost_tx_batch() toma la ruta de éxito y nunca libera la página. Cada fallo de build_skb() en un lote fuga un fragmento de página. Liberar la página antes de tomar la ruta de error, coincidiendo con el put_page() que las otras salidas de error de tun_xdp_one() ya realizan.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | CHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 2.5
Impact Score: 4.0
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a7390c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3844a2b00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384ab6440> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd369e823c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a739a80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a7392c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd319dd7680> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd2d39ff840> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd384ab55c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36a73be80> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd2a2df8940> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd341256e80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |