Note:
This project will be discontinued after December 13, 2021. [more]
2018-06-21
An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local denial of service and information leakage.
Products | Linux_kernel |
Type | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362) |
First patch |
https://github.com/torvalds/linux/commit/bd23a7269834dc7c1f93e83535d16ebc44b75eba |
Relevant file/s | ./drivers/virt/vboxguest/vboxguest_linux.c (modified, +3, -1) |
Links |
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bd23a7269834dc7c1f93e83535d16ebc44b75eba
• https://bugzilla.kernel.org/show_bug.cgi?id=200131 |
Navigation
Patch data:
Patched area:
(on by default)
Patched area: