In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a p…
Info
Summary
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit re…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb
- https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6
- https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4
- https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9
- https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf
- https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26
- https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb
- https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145
Timeline
- nvd_ingest NVD