CVE-2024-27066 virtio: packed: fix unmap leak for indirect desc table
A memory leak in the Linux kernel virtio driver can cause resource exhaustion and denial of service when specific DMA configurations are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27066?
CVE-2024-27066 is a high-severity memory corruption vulnerability in Linux kernel, published on 1 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
virtio: packed: fix unmap leak for indirect desc table
When use_dma_api and premapped are true, then the do_unmap is false.
Because the do_unmap is false, vring_unmap_extra_packed is not called by detach_buf_packed.
if (unlikely(vq->do_unmap)) { curr = id; for (i = 0; i < state->num; i++) { vring_unmap_extra_packed(vq, &vq->packed.desc_extra[curr]); curr = vq->packed.desc_extra[curr].next; } }
So the indirect desc table is not unmapped. This causes the unmap leak.
So here, we check vq->use_dma_api instead. Synchronously, dma info is updated based on use_dma_api judgment
This bug does not occur, because no driver use the premapped with indirect.
Weakness: CWE-401
Which versions are affected by CVE-2024-27066?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-27066?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-27066 being exploited?
There is no known exploitation of CVE-2024-27066 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-27066, DEBIAN-CVE-2024-27066, GHSA-857r-xmrg-gj95, UBUNTU-CVE-2024-27066.