Messages in this thread | | | Date | Wed, 31 Aug 2022 17:47:10 +0200 | Subject | Re: [PATCH v2] vduse: prevent uninitialized memory accesses | From | Maxime Coquelin <> |
| |
On 8/31/22 17:46, Michael S. Tsirkin wrote: > On Wed, Aug 31, 2022 at 05:01:11PM +0200, Maxime Coquelin wrote: >> On 8/29/22 09:48, Greg KH wrote: >>> On Mon, Aug 29, 2022 at 09:34:24AM +0200, Maxime Coquelin wrote: >>>> If the VDUSE application provides a smaller config space >>>> than the driver expects, the driver may use uninitialized >>>> memory from the stack. >>>> >>>> This patch prevents it by initializing the buffer passed by >>>> the driver to store the config value. >>>> >>>> This fix addresses CVE-2022-2308. >>>> >>>> Cc: xieyongji@bytedance.com >>>> Cc: stable@vger.kernel.org # v5.15+ >>>> Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") >>>> >>>> Acked-by: Jason Wang <jasowang@redhat.com> >>>> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> >>> >>> Please no blank line above the Acked-by: line here if possible. >> >> Sure. >> >> Jason, do you prefer I post a new revision with this single change or >> you will handle it while applying? Either way is fine to me. >> >> Thanks, >> Maxime > > I queue these normally.
Ok, I'm preparing the V2.
Thanks, Maxime
>>> thanks, >>> >>> greg k-h >>> >
| |