A vulnerability in the vhost-net driver within the Linux kernel
A vulnerability (CVE-2020-10942) has been identified in the vhost-net driver, which provides virtio net functionality on the host environment, allowing a local user to initiate a kernel stack overflow by sending a specially crafted ioctl(VHOST_NET_SET_BACKEND) to the /dev/vhost-net device. The issue arises from the lack of proper validation of the sk_family field content in the get_raw_socket() function code. Preliminary reports indicate that the vulnerability could be leveraged for a local DoS attack through kernel crash calls (details are […]
