Bug 922 - CVE-2022-0669 State: Confirmed (Issue in handling of vhost-user inflight type messages)
Summary: CVE-2022-0669 State: Confirmed (Issue in handling of vhost-user inflight type...
Status: RESOLVED FIXED
Alias: None
Product: DPDK
Classification: Unclassified
Component: vhost/virtio (show other bugs)
Version: 19.11
Hardware: All All
: Normal normal
Target Milestone: ---
Assignee: David Marchand
URL:
Depends on:
Blocks:
 
Reported: 2022-01-20 09:21 CET by Cheng Jiang
Modified: 2022-05-10 03:52 CEST (History)
4 users (show)



Attachments
Proposed fix rebased on 02/18 main repository, (1.71 KB, patch)
2022-02-18 10:52 CET, David Marchand
Details | Diff

Description Cheng Jiang 2022-01-20 09:21:50 CET
From the reporter:

Hello,

While reviewing the vhost library code, we identified an issue in the handling of vhost-user inflight type messages.

A malicious vhost-user master can attach an unexpected number of fds as anciliary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave.
By sending such messages continuously, the vhost-user master could exhaust available fd in the vhost-user slave process and lead to a DoS.


The problem was introduced with commit d87f1a1cb7b6 ("vhost: support inflight info sharing") and affects versions since v19.11.


This is similar to CVE-2019-14818 that was fixed in bf472259dde6
("vhost: fix possible denial of service by leaking FDs").


You can find attached a proposal for a fix.
Comment 1 Cheng Jiang 2022-02-16 06:56:04 CET
Maxime confirmed the issue.
Requesting the CVE number for it.
Comment 2 Cheng Jiang 2022-02-18 03:23:50 CET
Got the CVE number: CVE-2022-0669
I will proceed.
Thanks.
Comment 3 David Marchand 2022-02-18 10:52:36 CET
Created attachment 190 [details]
Proposed fix rebased on 02/18 main repository,
Comment 4 Cheng Jiang 2022-02-24 02:31:25 CET
Targeting dpdk 22.03 release.
Comment 5 Cheng Jiang 2022-02-24 03:07:51 CET
@David, Hi David, could you please tell me how would you like to be acknowledged on the CVE page?
Comment 6 Maxime Coquelin 2022-02-25 10:44:16 CET
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

I'm preparing the backports which will also include Bug 657.
Comment 7 Cheng Jiang 2022-03-08 09:55:07 CET
Decided to change the embargo date to April 29th.

And I have sent out the request for changing the embargo date to April 29th, no reply for now.
Comment 8 Cheng Jiang 2022-03-17 02:02:05 CET
Confirmed from RedHat product security team about the new disclosure date.
Comment 9 Cheng Jiang 2022-04-26 07:46:56 CEST
Hi,

We need to continue the process since the disclosure date is coming.
Comment 10 Cheng Jiang 2022-04-29 03:15:13 CEST
pre-release email sent. Thanks.
Comment 11 Cheng Jiang 2022-05-05 04:39:22 CEST
release email sent. Thanks.
Comment 12 Cheng Jiang 2022-05-06 08:25:53 CEST
This issue has been fixed and made public. Thanks.

Note You need to log in before you can comment on or make changes to this bug.