[Hyper-V] storvsc: do not assume SG list is continuous when doing bounce buffers
Bug #1742480 reported by
Joshua R. Poulson
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Trusty |
Fix Released
|
High
|
Marcelo Cerri |
Bug Description
All linux kernels 4.1 and prior use bounce buffers, and there is a data corruption vulnerability on Hyper-V without the following patch.
storvsc checks the SG list for gaps before passing them to Hyper-v device.
If there are gaps, data is copied to a bounce buffer and a continuous data
buffer is passed to Hyper-V.
The check on gaps assumes SG list is continuous, and not chained. This is
not always true. Failing the check may result in incorrect I/O data
passed to the Hyper-v device.
This code path is not used post Linux 4.1.
CVE References
Changed in linux (Ubuntu Trusty): | |
status: | New → Triaged |
importance: | Undecided → High |
assignee: | nobody → Marcelo Cerri (mhcerri) |
Changed in linux (Ubuntu): | |
status: | Incomplete → Fix Released |
Changed in linux (Ubuntu Trusty): | |
status: | Triaged → Fix Committed |
To post a comment you must log in.
This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:
apport-collect 1742480
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.