Bug 1220527 (CVE-2021-46967) - VUL-0: CVE-2021-46967: kernel-source,kernel-source-azure,kernel-source-rt: vhost-vdpa: missing vm_flags for virtqueue doorbell mapping may cause a panic
Summary: VUL-0: CVE-2021-46967: kernel-source,kernel-source-azure,kernel-source-rt: vh...
Status: RESOLVED FIXED
Alias: CVE-2021-46967
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Kernel Bugs
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/395373/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-46967:5.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-28 09:14 UTC by SMASH SMASH
Modified: 2024-02-28 09:15 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-02-28 09:14:57 UTC 
In the Linux kernel, the following vulnerability has been resolved:

vhost-vdpa: fix vm_flags for virtqueue doorbell mapping

The virtqueue doorbell is usually implemented via registeres but we
don't provide the necessary vma->flags like VM_PFNMAP. This may cause
several issues e.g when userspace tries to map the doorbell via vhost
IOTLB, kernel may panic due to the page is not backed by page
structure. This patch fixes this by setting the necessary
vm_flags. With this patch, try to map doorbell via IOTLB will fail
with bad address.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-46967
https://www.cve.org/CVERecord?id=CVE-2021-46967
https://git.kernel.org/stable/c/3a3e0fad16d40a2aa68ddf7eea4acdf48b22dd44
https://git.kernel.org/stable/c/3b8b6399666a29daa30b0bb3f5c9e3fc81c5a6a6
https://git.kernel.org/stable/c/93dbbf20e3ffad14f04227a0b7105f6e6f0387ce
https://git.kernel.org/stable/c/940230a5c31e2714722aee04c521a21f484b4df7
Comment 1 Carlos López 2024-02-28 09:15:49 UTC 
We have ddd89d0a059d ("vhost_vdpa: support doorbell mapping via mmap") in cve/linux-5.14, SLE15-SP6, stable and master, all of which have the fix. Closing.