Vulnerability in virtio-net package: Pages Leaking in Big Mode
Summary
GSD-2021-1001758: virtio-net: fix pages leaking when building skb in big mode. Affects Kernel versions >= fb32856b16ad9d5bcd75b76a274e2c515ac7b9d7, < f020bb63b5d2e5576acadd10e158fe3b04af67ba. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The virtio-net package is a virtual network device driver used in the Linux Kernel. It provides a high-performance, paravirtualized network interface for virtual machines. The package enables efficient communication between the guest operating system and the host system. However, a vulnerability has been discovered in the package when building skb (socket buffer) in big mode.
Vulnerability Detail
The vulnerability in virtio-net occurs when building skb in big mode. It can result in pages leaking, potentially leading to memory corruption or information disclosure. This vulnerability was introduced in Linux Kernel version v5.13 by commit fb32856b16ad9d5bcd75b76a274e2c515ac7b9d7 and has been fixed in version v5.14.9 by commit f020bb63b5d2e5576acadd10e158fe3b04af67ba. The impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in virtio-net that causes pages leaking when building skb in big mode has been identified and fixed in Linux Kernel version v5.14.9. It is recommended to update the Linux Kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
virtio-net is a virtual network device driver used in the Linux Kernel to provide a high-performance, paravirtualized network interface for virtual machines.
skb (socket buffer) is a data structure used in the Linux Kernel to hold network packets. It contains information such as the packet data, length, and network protocol.
Big mode in virtio-net refers to a specific mode of operation where skb is built using larger pages. This mode can lead to the pages leaking vulnerability.
The pages leaking vulnerability in virtio-net can potentially result in memory corruption or information disclosure, depending on how it is exploited.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you in real-time if any open-source vulnerabilities, including this one, are detected.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
