Bugzilla – Bug 1226600
VUL-0: CVE-2021-47613: kernel: i2c: virtio: fix completion handling
Last modified: 2024-06-24 13:50:17 UTC
In the Linux kernel, the following vulnerability has been resolved: i2c: virtio: fix completion handling The driver currently assumes that the notify callback is only received when the device is done with all the queued buffers. However, this is not true, since the notify callback could be called without any of the queued buffers being completed (for example, with virtio-pci and shared interrupts) or with only some of the buffers being completed (since the driver makes them available to the device in multiple separate virtqueue_add_sgs() calls). This can lead to incorrect data on the I2C bus or memory corruption in the guest if the device operates on buffers which are have been freed by the driver. (The WARN_ON in the driver is also triggered.) BUG kmalloc-128 (Tainted: G W ): Poison overwritten First byte 0x0 instead of 0x6b Allocated in i2cdev_ioctl_rdwr+0x9d/0x1de age=243 cpu=0 pid=28 memdup_user+0x2e/0xbd i2cdev_ioctl_rdwr+0x9d/0x1de i2cdev_ioctl+0x247/0x2ed vfs_ioctl+0x21/0x30 sys_ioctl+0xb18/0xb41 Freed in i2cdev_ioctl_rdwr+0x1bb/0x1de age=68 cpu=0 pid=28 kfree+0x1bd/0x1cc i2cdev_ioctl_rdwr+0x1bb/0x1de i2cdev_ioctl+0x247/0x2ed vfs_ioctl+0x21/0x30 sys_ioctl+0xb18/0xb41 Fix this by calling virtio_get_buf() from the notify handler like other virtio drivers and by actually waiting for all the buffers to be completed. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47613 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2021/CVE-2021-47613.mbox https://git.kernel.org/stable/c/9cbb957441ed8873577d7d313a3d79d69f1dad5c https://git.kernel.org/stable/c/b503de239f62eca898cfb7e820d9a35499137d22 https://www.cve.org/CVERecord?id=CVE-2021-47613
All affected branches contain the fix. nop for us b503de239f62 ("i2c: virtio: fix completion handling") merged v5.16-rc5~13^2~1 Fixes: 3cfc88380413 ("i2c: virtio: add a virtio i2c frontend driver") merged v5.15-rc1~164^2~3 Security fix for CVE-2021-47613 bsc#1226600 with CVSS 5.3 Experts candidates: jgross@suse.com fabiano.rosas@suse.com dfaggioli@suse.com .......................... NO ACTION NEEDED: All relevant branches contain the fix!
All done, closing.