vhost: fix possible denial of service on SET_VRING_NUM
authorMaxime Coquelin <maxime.coquelin@redhat.com>
Fri, 23 Aug 2019 13:17:05 +0000 (15:17 +0200)
committerDavid Marchand <david.marchand@redhat.com>
Tue, 12 Nov 2019 11:21:17 +0000 (12:21 +0100)
commit612e17cf6d7b2bf05a687d8a9ba7be582a744e50
tree33485ef4ae769e816c8f86d3bbd7fbcc0236ce33
parent31aa07759ecd151967b568b1f1aa12b7794217c8
vhost: fix possible denial of service on SET_VRING_NUM

vhost_user_set_vring_num() performs multiple allocations
without checking whether data were previously allocated.

It may cause a denial of service because of the memory leaks
that happen if a malicious vhost-user master keeps sending
VHOST_USER_SET_VRING_NUM request until the slave runs out
of memory.

This issue has been assigned CVE-2019-14818

Fixes: b0a985d1f340 ("vhost: add dequeue zero copy")

Reported-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
lib/librte_vhost/vhost_user.c