Description
An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Kernel | Linux kernel 5.17-rc1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.15.15-1 | — |
| Debian 13 | linux | 5.15.15-1 | — |
| Debian 12 | linux | 5.15.15-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-aws-5.13 | 5.13.0-1019.21~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure-5.13 | 5.13.0-1021.24~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.13 | 5.13.0-1021.25~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-hwe-5.13 | 5.13.0-37.42~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oem-5.14 | 5.14.0-1022.24 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.13 | 5.13.0-1025.30~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-riscv +17 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +12 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | kernel | 5.15.37.1-2 | — |