CVE-2023-5158: Possible dos from guest to host invringh_kiov_advance in vhost driver at drivers/vhost/vringh.c
A flaw was found in vringhkiovadvance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of service from guest to host via zero length descriptor.
Other sources
A possible DOS from guest to host via zero length descriptor. This is because currently the vringhkiovadvance() did something like this:
while (len && iov->i < iov->used) { ... if (!iov->iov[iov->i].iovlen) { ... iov->i++; } }
When the length of the descriptor is zero, we miss the chance to advance iov->i.
The fix is to revert b8c06ad4d67db56ed6bdfb685c134da74e92a2c7 ("vringh: implement vringhkiovadvance()").
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-5158?
CVE-2023-5158 is a vulnerability that affects the vringh_kiov_advance function in the host side of a virtio ring in the Linux Kernel.
How severe is CVE-2023-5158?
CVE-2023-5158 has a severity rating of 6.5, which is considered medium.
What is the affected software of CVE-2023-5158?
The affected software of CVE-2023-5158 is the Linux Kernel version up to but excluding 5.13.
What is the impact of CVE-2023-5158?
CVE-2023-5158 may result in a denial of service from guest to host via zero length descriptor.
How can the CVE-2023-5158 vulnerability be fixed?
To fix the CVE-2023-5158 vulnerability, update the Linux Kernel to version 5.13 or later.