UBUNTU-CVE-2017-12190
The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.
02 / AFFECTED SOFTWARE
Affected packages
126 explicit affected versions
8 explicit affected versions
48 explicit affected versions
69 explicit affected versions
29 explicit affected versions
6 explicit affected versions
5 explicit affected versions
26 explicit affected versions
9 explicit affected versions
43 explicit affected versions
40 explicit affected versions
26 explicit affected versions
51 explicit affected versions
6 explicit affected versions
12 explicit affected versions
1 explicit affected versions
1 explicit affected versions
23 explicit affected versions
7 explicit affected versions
7 explicit affected versions
8 explicit affected versions
7 explicit affected versions
1 explicit affected versions
61 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.
05 / REFERENCES
Further evidence
- https://bugzilla.redhat.com/show_bug.cgi?id=1495089
- https://bugzilla.suse.com/show_bug.cgi?id=1062568
- https://marc.info/?t=150605752800001&r=1&w=2
- https://ubuntu.com/security/CVE-2017-12190
- https://ubuntu.com/security/notices/USN-3487-1
- https://ubuntu.com/security/notices/USN-3582-1
- https://ubuntu.com/security/notices/USN-3582-2
- https://ubuntu.com/security/notices/USN-3583-1
- https://ubuntu.com/security/notices/USN-3583-2
- https://www.cve.org/CVERecord?id=CVE-2017-12190
- https://www.mail-archive.com/[email protected]/msg1495884.html
- https://www.mail-archive.com/[email protected]/msg1495887.html