Re: CVE-2021-47581: xen/netback: don't queue unlimited number of packages

Re: CVE-2021-47581: xen/netback: don't queue unlimited number of packages

[Juergen Gross]

[-- Attachment #1.1.1: Type: text/plain, Size: 1318 bytes --]

On 19.06.24 16:54, Greg Kroah-Hartman wrote:
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> xen/netback: don't queue unlimited number of packages
> 
> In case a guest isn't consuming incoming network traffic as fast as it
> is coming in, xen-netback is buffering network packages in unlimited
> numbers today. This can result in host OOM situations.
> 
> Commit f48da8b14d04ca8 ("xen-netback: fix unlimited guest Rx internal
> queue and carrier flapping") meant to introduce a mechanism to limit
> the amount of buffered data by stopping the Tx queue when reaching the
> data limit, but this doesn't work for cases like UDP.
> 
> When hitting the limit don't queue further SKBs, but drop them instead.
> In order to be able to tell Rx packages have been dropped increment the
> rx_dropped statistics counter in this case.
> 
> It should be noted that the old solution to continue queueing SKBs had
> the additional problem of an overflow of the 32-bit rx_queue_len value
> would result in intermittent Tx queue enabling.
> 
> This is part of XSA-392
> 
> The Linux kernel CVE team has assigned CVE-2021-47581 to this issue.

When issuing XSA-392 the Xen security team already assigned CVE-2021-28715
to this issue.


Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]