CVE-2021-47575
June 19, 2024, 3:15 p.m.
None
No Score
Description
In the Linux kernel, the following vulnerability has been resolved:
xen/console: harden hvc_xen against event channel storms
The Xen console driver is still vulnerable for an attack via excessive
number of events sent by the backend. Fix that by using a lateeoi event
channel.
For the normal domU initial console this requires the introduction of
bind_evtchn_to_irq_lateeoi() as there is no xenbus device available
at the time the event channel is bound to the irq.
As the decision whether an interrupt was spurious or not requires to
test for bytes having been read from the backend, move sending the
event into the if statement, as sending an event without having found
any bytes to be read is making no sense at all.
This is part of XSA-391
---
V2:
- slightly adapt spurious irq detection (Jan Beulich)
V3:
- fix spurious irq detection (Jan Beulich)
Product(s) Impacted
Product | Versions |
---|---|
Linux kernel |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
References
Tags
Timeline
Published: June 19, 2024, 3:15 p.m.
Last Modified: June 19, 2024, 3:15 p.m.
Last Modified: June 19, 2024, 3:15 p.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
416baaa9-dc9f-4396-8d5f-8c081fb06d67
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.