https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 11:53:37 +0000 https://vulnerability.circl.lu/vuln/cve-2023-53998 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>hwrng: virtio - Fix race on data_avail and actual data</p> <p>The virtio rng device kicks off a new entropy request whenever the data available reaches zero. When a new request occurs at the end of a read operation, that is, when the result of that request is only needed by the next reader, then there is a race between the writing of the new data and the next reader.</p> <p>This is because there is no synchronisation whatsoever between the writer and the reader.</p> <p>Fix this by writing data_avail with smp_store_release and reading it with smp_load_acquire when we first enter read. The subsequent reads are safe because they&#39;re either protected by the first load acquire, or by the completion mechanism.</p> <p>Also remove the redundant zeroing of data_idx in random_recv_done (data_idx must already be zero at this point) and data_avail in request_entropy (ditto).</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>hwrng: virtio - Fix race on data_avail and actual data</p> <p>The virtio rng device kicks off a new entropy request whenever the data available reaches zero. When a new request occurs at the end of a read operation, that is, when the result of that request is only needed by the next reader, then there is a race between the writing of the new data and the next reader.</p> <p>This is because there is no synchronisation whatsoever between the writer and the reader.</p> <p>Fix this by writing data_avail with smp_store_release and reading it with smp_load_acquire when we first enter read. The subsequent reads are safe because they&#39;re either protected by the first load acquire, or by the completion mechanism.</p> <p>Also remove the redundant zeroing of data_idx in random_recv_done (data_idx must already be zero at this point) and data_avail in request_entropy (ditto).</p> https://vulnerability.circl.lu/vuln/cve-2023-53998