In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential unbounded skb queue virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. virtio_transport_recv_enqueue() skips coalescing for packets with VIRTIO_VSOCK_SEQ_EOM. If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, a very large number of packets can be queued because vvs->rx_bytes stays at 0. Fix this by estimating the skb metadata size: (Number of skbs in the queue) * SKB_TRUESIZE(0)
| Vendor | Product | Versions |
|---|---|---|
| linux | linux kernel | 077706165717686a2a6a71405fef036cd5b37ae0, 077706165717686a2a6a71405fef036cd5b37ae0, 077706165717686a2a6a71405fef036cd5b37ae0, 077706165717686a2a6a71405fef036cd5b37ae0, 5852a2b573f7a3a29df46296e56aa3491e589cdf, 6.1.63, 6.3 |
Updated severity to CRITICAL, added new affected versions, and noted no exploit available.
Updated description with more technical detail, added affected versions, changed severity to HIGH, and marked exploit available and actively exploited.
Initial creation
