GHSA-8R8Q-58JP-V725

Vulnerability from github – Published: 2024-06-19 15:30 – Updated: 2024-06-19 15:30
VLAI?
Details

In the Linux kernel, the following vulnerability has been resolved:

xen/console: harden hvc_xen against event channel storms

The Xen console driver is still vulnerable for an attack via excessive number of events sent by the backend. Fix that by using a lateeoi event channel.

For the normal domU initial console this requires the introduction of bind_evtchn_to_irq_lateeoi() as there is no xenbus device available at the time the event channel is bound to the irq.

As the decision whether an interrupt was spurious or not requires to test for bytes having been read from the backend, move sending the event into the if statement, as sending an event without having found any bytes to be read is making no sense at all.

This is part of XSA-391

V2: - slightly adapt spurious irq detection (Jan Beulich) V3: - fix spurious irq detection (Jan Beulich)

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-47575"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T15:15:52Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/console: harden hvc_xen against event channel storms\n\nThe Xen console driver is still vulnerable for an attack via excessive\nnumber of events sent by the backend. Fix that by using a lateeoi event\nchannel.\n\nFor the normal domU initial console this requires the introduction of\nbind_evtchn_to_irq_lateeoi() as there is no xenbus device available\nat the time the event channel is bound to the irq.\n\nAs the decision whether an interrupt was spurious or not requires to\ntest for bytes having been read from the backend, move sending the\nevent into the if statement, as sending an event without having found\nany bytes to be read is making no sense at all.\n\nThis is part of XSA-391\n\n---\nV2:\n- slightly adapt spurious irq detection (Jan Beulich)\nV3:\n- fix spurious irq detection (Jan Beulich)",
  "id": "GHSA-8r8q-58jp-v725",
  "modified": "2024-06-19T15:30:54Z",
  "published": "2024-06-19T15:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47575"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/153d1ea3272209fc970116f09051002d14422cde"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/560e64413b4a6d9bd6630e350d5f2e6a05f6ffe3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/57e46acb3b48ea4e8efb1e1bea2e89e0c6cc43e2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/68b78f976ca47d52c03c41eded207a312e46b934"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/728389c21176b2095fa58e858d5ef1d2f2aac429"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8fa3a370cc2af858a9ba662ca4f2bd0917550563"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c7eaa5082bccfc00dfdb500ac6cc86d6f24ca027"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fe415186b43df0db1f17fa3a46275fd92107fe71"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.