CVE-2021-46967 vhost-vdpa: fix vm_flags for virtqueue doorbell mapping
A missing flag in the Linux kernel vhost-vdpa driver causes a kernel panic when userspace maps the doorbell, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-46967?
CVE-2021-46967 is a high-severity vulnerability in Linux kernel, published on 27 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix vm_flags for virtqueue doorbell mapping
The virtqueue doorbell is usually implemented via registeres but we don't provide the necessary vma->flags like VM_PFNMAP. This may cause several issues e.g when userspace tries to map the doorbell via vhost IOTLB, kernel may panic due to the page is not backed by page structure. This patch fixes this by setting the necessary vm_flags. With this patch, try to map doorbell via IOTLB will fail with bad address.
Which versions are affected by CVE-2021-46967?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-46967?
Apply the vendor's patch.
Is CVE-2021-46967 being exploited?
There is no known exploitation of CVE-2021-46967 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-46967, GHSA-2prc-4f47-p38v, UBUNTU-CVE-2021-46967.