* Re: CVE-2021-47581: xen/netback: don't queue unlimited number of packages
[not found] <2024061916-CVE-2021-47581-1d34@gregkh>
@ 2024-06-20 7:57 ` Juergen Gross
0 siblings, 0 replies; only message in thread
From: Juergen Gross @ 2024-06-20 7:57 UTC (permalink / raw)
To: cve, linux-kernel, linux-cve-announce; +Cc: Greg Kroah-Hartman
[-- Attachment #1.1.1: Type: text/plain, Size: 1318 bytes --]
On 19.06.24 16:54, Greg Kroah-Hartman wrote:
> Description
> ===========
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> xen/netback: don't queue unlimited number of packages
>
> In case a guest isn't consuming incoming network traffic as fast as it
> is coming in, xen-netback is buffering network packages in unlimited
> numbers today. This can result in host OOM situations.
>
> Commit f48da8b14d04ca8 ("xen-netback: fix unlimited guest Rx internal
> queue and carrier flapping") meant to introduce a mechanism to limit
> the amount of buffered data by stopping the Tx queue when reaching the
> data limit, but this doesn't work for cases like UDP.
>
> When hitting the limit don't queue further SKBs, but drop them instead.
> In order to be able to tell Rx packages have been dropped increment the
> rx_dropped statistics counter in this case.
>
> It should be noted that the old solution to continue queueing SKBs had
> the additional problem of an overflow of the 32-bit rx_queue_len value
> would result in intermittent Tx queue enabling.
>
> This is part of XSA-392
>
> The Linux kernel CVE team has assigned CVE-2021-47581 to this issue.
When issuing XSA-392 the Xen security team already assigned CVE-2021-28715
to this issue.
Juergen
[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]
^ permalink raw reply [flat|nested] only message in thread