Executive Summary

This vulnerability exists in the Linux kernel's vsock/virtio component, where a potential unbounded skb (socket buffer) queue can occur.

The issue arises because the function virtio_transport_inc_rx_pkt() checks if the sum of received bytes plus the length of a new packet exceeds a buffer allocation limit, but packets with length zero and a specific flag (VIRTIO_VSOCK_SEQ_EOM) can bypass normal coalescing and queuing limits.

As a result, a very large number of such zero-length packets can be queued indefinitely since the received bytes counter does not increase, potentially leading to resource exhaustion.

The fix involves estimating the skb metadata size by multiplying the number of skbs in the queue by a constant size (SKB_TRUESIZE(0)) to properly limit the queue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to an unbounded queue of socket buffers in the Linux kernel, which may cause resource exhaustion such as memory consumption.

If exploited, it could degrade system performance or potentially cause denial of service by exhausting kernel memory resources.

Useful 0 Not Useful 0