A vhost-net driver, which provides the operation of virtio net on the host environment, vulnerability (), allowing a local user to initiate a kernel stack overflow by sending a specially formatted ioctl(VHOST_NET_SET_BACKEND) to the /dev/vhost-net device. The issue is caused by the lack of proper validation of the sk_family field in the get_raw_socket() function code.
Preliminary data indicates that the vulnerability can be exploited for a local DoS attack by causing a kernel crash (there is no information about the use of the stack overflow vulnerability for code execution).
Sérülékenység in the Linux kernel update 5.5.8. For distributions, you can track package update releases on the pages , , , , , .
Forrás: opennet.ru
